黑客技术
点击放大
linux-kernel-exploitation - A collection of links related to Linux kernel secu
项目说明
Linux Kernel Exploitation
=========================
A collection of links related to Linux kernel security and exploitation.
Updated bimonthly. Pull requests are welcome as well.
Follow on X, @ on Mastodon, or on Bluesky to be notified of updates.
Subscribe to on , X, Mastodon, Bluesky, or Reddit for highlights.
Trainings
See xairy.io/trainings/.
Contents
- Exploitation
- Protection Bypasses
- Info-leaks
- LPE
- RCE
- KVM
- Other
- Fuzzers
- Assorted
- Workshops
- CTF Tasks
- Other Tasks
- Playgrounds
- Infrastructure
Books
2014: "Android Hacker's Handbook" by Joshua J. Drake [book]
2012: "A Guide to Kernel Exploitation: Attacking the Core" by Enrico Perla and Massimiliano Oldani [book] [materials]
Techniques
Exploitation
2026: "Fence2Pwn: KFENCE-Enabled Kernel Exploitation Bypassing Slab Hardening and Memory Tagging" by Ernesto Martinez Garcia et al. [paper]
2026: "Disco, characterizing and exploiting controllable-copy objects for kernel data-only attacks with CopyKat" by Jakob Koschel et al. [paper]
2026: "socket(0,2,0) - Re modprobe_path again" by leo_something and BitFriends [article]
2026: "Kernel-Exploit-Dojo" [code]
2026: "Kernel-Hack-Drill Masterclass" by Alexander Popo]
2026: "PhantomMap: GPU-Assisted Kernel Exploitation" by Jiayi Hu et al. [paper] [slides] [video]
2026: "Some notes on the security properties of the pipe_buffer kernel object" by Alexander Popo]
2026: "Cross-Cache Attacks for the Linux Kernel via PCP Massaging" by Claudio Migliorelli et al. [paper]
2026: "Heap Localization: Cache Side-Channel based Linux Kernel Heap Exploit Techniques" by Yoochan Lee et al. [paper]
2026: "Improving Linux Heap Exploit Reliability with FreshSlices and CPU-Bullying" [article]
2026: "DIRTYFREE: Simplified Data-Oriented Programming in the Linux Kernel" [paper]
2026: "Table Manners: Diving into Linux pagetables exp techniques" by Lau [slides]
2025: "CROSS-X: Generalized and Stable Cross-Cache Attack on the Linux Kernel" by Dong-ok Kim et al. [paper]
2025: "BRIDGEROUTER: Automated Capability Upgrading of Out-Of-Bounds Write to Arbitrary Memory Write Primitives in the Linux Kernel" [paper]
2025: "Extending Kernel Race Windows Using '/dev/shm'" by Faith [article]
2025: "System Register Hijacking: Compromising Kernel Integrity By Turning System Registers Against the System" [paper]
2025: "Linux Kernel Exploitation for Beginners" by Ke [slides] [video]
2025: "KernelGP: Racing Against the Android Kernel" by Chariton Karamitas [video]
2025: "Control Flow Hijacking in the Linux Kernel" by Yashniko] [video]
2025: "Kernel Exploitation Techniques: Turning The (Page) Tables" by Samuel Page [article]
2025: "Linux Kernel Exploitation series" by r1ru [articles] [代码]
2025: "Re the modprobe_path Technique: O search_binary_handler() Patch" [article]
2025: "WHEN GOOD KERNEL DEFENSES GO BAD: Reliable and Stable Kernel Exploits TLB Side-Channel Leaks" by Lukas Maar et al. [paper] [artifacts] [github]
2025: "Cross Cache Attack CheetSheet" by Pumpkin Chang [article]
2024: "Cross Cache for Lazy People -- The Padding Spray Method" [article]
2024: "Linux Kernel Use Pipe Object to Do Data-Only Attack" by Pumpkin Chang [article]
2024: "CTF-style Tricks of Linux Kernel Exploitation" by Pumpkin Chang [article] [part 2]
2024: "Linux Kernel exploitation cheatsheet" by Pumpkin Chang [article]
2024: "SLUB Internals for Exploit De" by Andrey Konovalo] [video]
2024: "SCA Discovery of Memory Corruption Targets in Linux Kernel for Pri Escalation" [paper]
2024: "PageJack: A Powerful Exploit Technique With Page-Level UAF" by Zhiyun Qian et al. [slides] [video] [代码] [summary]
2024: "SLUBStick: Arbitrary Memory Writes through Practical Software Cross-Cache Attacks within the Linux Kernel" by Lukas Maar et al. [paper]
2024: "Linux Kernel Exploitation - ret2usr" by Sascha Schirra [article]
2024: "Binary Exploitation Notes: Kernel" by Andrej Ljubic [articles]
2024: "Take a Step Further: Understanding Page Spray in Linux Kernel Exploitation" [paper]
2024: "GhostRace: Exploiting and Mitigating Speculative Race Conditions" [paper]
2024: "K-LEAK: Towards Automating the Generation of Multi-Step Infoleak Exploits against the Linux Kernel" [paper]
2024: "Beyond Control: Exploring Novel File System Objects for Data-Only Attacks on Linux Systems" [paper]
2023: "Deep-Kernel Treasure Hunt: Finding exploitable structures in the Linux kernel" by Yudai Fujiwara [slides] [video]
2023: "D^ 3CTF2023 d3kcache: From null-byte cross-cache o to infinite arbitrary read & write." [article]
2023: "No Tux Given: Diving Into Contemporary Linux Kernel Exploitation" by sam4k [slides]
2023: "Linux Kernel Exploitation series" by santaclz [article] [part2] [part 3]
2023: "RetSpill: Igniting User-Controlled Data to Burn Away Linux Kernel Protections" [paper]
2023: "Understanding Dirty Pagetable - m0leCon Finals 2023 CTF Writeup" [article]
2023: "Abusing RCU callbacks with a Use-After-Free read to defeat KASLR" [article]
2023: "Evils in the Sparse Texture Memory: Exploit Kernel Based on Undefined Behaviors of Graphic APIs" [slides] [abstract]
2023: "Make KSMA Great Again: The Art of Rooting Android devices by GPU MMU features" by Yong Wang [video] [slides]
2023: "A new method for container escape using file-based DirtyCred" by Choo Yi Kai [article]
2023: "prctl anon_: An Amusing Linux Kernel Heap Spray" by Cherie-Anne Lee [article]
2023: "Dirty Pagetable: A No Technique To Rule Linux Kernel" by Nicolas Wu [article]
2023: "Exploit Engineering – Attacking the Linux Kernel" by Alex Plaskett and Cedric Halbronn [slides] [video]
2023: "Algorithmic Heap Layout Manipulation in the Linux Kernel" by Max Ufer and Daniel Baier [paper] [artifacts]
2023: "The Return of Stack O in the Linux Kernel" by Davide Ornaghi [slides] [video]
2023: "Exploiting null-dereferences in the Linux kernel" by Seth Jenkins [article]
2023: "PSPRAY: Timing Side-Channel based Linux Kernel Heap Exploitation Technique" [paper] [video]
2023: "Linux Kernel PWN | 06 DirtyCred" [article]
2023: "Linux Kernel PWN | 05 ret2dir" [article]
2022: "Ret2page: The Art of Exploiting Use-After-Free in the Dedicated Cache" [slides] [video]
2022: "Devils Are in the File Descriptors: It Is Time To Catch Them All" by Le Wu [slides] [video]
2022: "FUSE for Linux Exploitation 101" [article]
2022: "Kernel Exploit Recipes" [brochure]
2022: "pipe_buffer arbitrary read write" by Jayden R [article]
2022: "Joy of exploiting the Kernel" [slides]
2022: "An exploit primitive in the Linux kernel inspired by DirtyPipe" [article]
2022: "DirtyCred: Escalating Pri in Linux Kernel" [paper] [slides] [artifacts]
2022: "DirtyCred: Cautious! A New Exploitation Method! No Pipe but as Nasty as Dirty Pipe" [slides] [artifacts]
2022: "CoRJail: From Null Byte O To Docker Escape Exploiting poll_list Objects In The Linux Kernel" [article]
2022: "Re Exploits Against Cred Structs - Six Byte Cross Cache O to Leakless Data-Oriented Kernel Pwnage" [article]
2022: "USMA: Share Kernel 代码 With Me" by Yong Liu et al. [slides] [video] [paper] [article]
2022: "Linux kernel heap feng shui in 2022" by Michael S and Nikolenko [article]
2022: "LiKE: A Series on Linux Kernel Exploitation" by sam4k [article] [modprobe_path]
2022: "Racing against the clock -- hitting a tiny kernel race window" by Jann Horn [article]
2022: "Playing for K(H)eaps: Understanding and Improving Linux Kernel Exploit Reliability" [paper] [artifacts]
2022: "Learning Linux kernel exploitation" by 0x434b [article] [part 2]
2021: "ExpRace: Exploiting Kernel Races through Raising Interrupts" at USENIX [paper] [slides] [video]
2021: "Utilizing msg_msg Objects for Arbitrary Read and Arbitrary Write in the Linux Kernel" [article] [part2]
2021: "Linux Kernel Exploitation Technique: O modprobe_path" [article]
2021: "Learning Linux Kernel Exploitation" [article] [part 2] [part 3]
2020: "PTMA (Page Table Manipulation Attack): Attacking the core of memory permission" [slides]
2020: "Exploiting Kernel Races Through Taming Thread Interleaving" [slides] [video]
2020: "Locating the kernel PGD on Android/aarch64" by Nikolenko [article]
2020: "A Systematic Study of Elastic Objects in Kernel Exploitation" [paper] [video]
2020: "Exploiting Uses of Uninitialized Stack in Linux Kernels to Leak Kernel Pointers" [slides] [paper] [video]
2020: "BlindSide: Speculati: Hacking Blind in the Spectre Era" [paper]
2020: "Linux Kernel Stack Smashing" by Sil [article]
2020: "Structures that can be used in kernel exploits" [article]
2019: "The Route to Root: Container Escape Using Kernel Exploitation" by Nimrod Stoler [article]
2019: "Linux Kernel: the ROP Exploit of Stack O in Android Kernel" [article]
2019: "Hands Off and Putting SLAB/SLUB Feng Shui in Blackbox" by Yueqi (Lewis) Chen at Black Hat Europe [slides] [代码]
2019: "SLAKE: Facilitating Slab Manipulation for Exploiting in the Linux Kernel" by Yueqi (Lewis) Chen and Xinyu Xing [slides] [paper]
2019: "Exploiting Race Conditions Using the Scheduler" by Jann Horn at Linux Security Summit EU [slides] [video]
2019: "Kepler: Facilitating Control-flow Hijacking Primiti for Linux Kernel " [slides] [video] [paper]
2019: "Leak kernel pointer by exploiting uninitialized uses in Linux kernel" by Jinbum Park [slides]
2019: "Kernel IDT pri escalation" [article]
2018: "FUZE: Towards Facilitating Exploit Generation for Kernel Use-After-Free " [slides] [paper]
2018: "Linux Kernel uni heap spray" by Nikolenko [article]
2018: "Linux-Kernel-Exploit Stack Smashing" [article]
2018: "Entering God Mode - The Kernel Space Mirroring Attack" [article]
2018: "Mirror Mirror: Rooting Android 8 with a Kernel Space Mirroring Attack" by Wang Yong at HitB [slides]
2018: "KSMA: Breaking Android kernel isolation and Rooting with ARM MMU features" by Wang Yong at BlackHat [slides]
2018: "Still Hammerable and Exploitable: on the Effecti of Software-only Physical Kernel Isolation" [paper]
2018: "linux kernel pwn notes" [article]
2018: "Use of timer_list structure in linux kernel exploit" [article]
2018: "Entering God Mode — The Kernel Space Mirroring Attack" [article]
2017: "Escalating Pri in Linux using Fault Injection" by Niek Timmers and Cristofaro Mune [slides] [video] [paper]
2017: "Kernel Driver mmap Handler Exploitation" by Mateusz Fruba [paper]
2017: "Linux kernel addr_limit bug / exploitation" by Nikolenko [video]
2017: "The Stack Clash" by Qualys Research Team [article]
2017: "New Reliable Android Kernel Root Exploitation Techniques" [slides]
2017: "Unleashing Use-Before-Initialization in the Linux Kernel Using Targeted Stack Spraying" [paper]
2017: "Breaking KASLR with perf" by Lizzie Dixon [article]
2017: "Linux kernel exploit cheetsheet" [article]
2016: "Getting Physical Extreme abuse of Intel based Paging Systems" by Nicolas Economou and Enrique Nissim [slides]
2016: "Linux Kernel ROP - Ropping your way to # (Part 1)" by Nikolenko/) [article] [exercise]
2016: "Linux Kernel ROP - Ropping your way to # (Part 2)" by Nikolenko/) [article]
2016: "Exploiting COF in the Linux kernel" by Nikolenko at Ruxcon [slides]
2016: "Using userfaultfd" by Lizzie Dixon [article]
2016: "Direct Memory Attack the Kernel" by Ulf Frisk at DEF CON [video]
2016: "Randomization Can't Stop BPF JIT Spray" by Elena Reshetova at Black Hat [slides] [video] [paper]
2015: "Kernel Data Attack is a Realistic Security Threat" [paper]
2015: "From Collision To Exploitation: Unleashing Use-After-Free in Linux Kernel" [paper]
2015: "Modern Binary Exploitation: Linux Kernel Exploitation" by Patrick Biernat [slides] [exercise]
2013: "Hacking like in the Movies: Page Tables for Local Exploitation" at Black Hat
2013: "Exploiting linux kernel heap corruptions" by Mohamed Channam [article]
2012: "Writing kernel exploits" by Keegan McAllister [slides]
2012: "Understanding Linux Kernel " by Richard Carback [slides]
2012: "A Heap of Trouble: Breaking the Linux Kernel SLOB Allocator" by Dan Rosenberg [paper]
2012: "Attacking hardened Linux systems with kernel JIT spraying" by Keegan McAllister [article] [代码 1] [代码 2]
2012: "The Linux kernel memory allocators from an exploitation perspective" by Patroklos Argyroudis [article]
2012: "The Stack is Back" by Jon Oberheide [slides]
2012: "Stackjacking" by Jon Oberheide and Dan Rosenberg [slides]
2011: "Stackjacking Your Way to grsec/PaX Bypass" by Jon Oberheide [article]
2010: "Much ado about NULL: Exploiting a kernel NULL dereference" [article]
2010: "Exploiting Stack O in the Linux Kernel" by Jon Oberheide [article]
2010: "Linux Kernel Exploitation: Earning Its Pwnie a Vuln at a Time" by Jon Oberheide at 源码 Boston [slides]
2009: "There's a party at ring0, and you're invited" by Ta and Julien Tinnes at CanSecWest [slides]
2007: "Kernel-mode exploits primer" by Syl Keil and Clemens Kolbitsch [paper]
2007: "Attacking the Core : Kernel Exploiting Notes" [article]
2007: "The story of exploiting kmalloc() o" [article]
2007: "Linux 2.6 Kernel Exploits" by Stephane Du [slides]
2005: "Large memory management " by Gael Delalleau at CanSecWest [slides]
2005: "The story of exploiting kmalloc() o" [article]
Protection Bypasses
2026: "Re Two-Shot Kernel Shellcode Execution From Control Flow Hijacking" by Jennifer Miller [article]
2025: "Defeating KASLR by Doing Nothing at All" by Seth Jenkins [article]
2025: "The Journey of Bypassing Ubuntu’s Unpri Namespace Restriction" by Pumpkin Chang [article]
2025: "Exploring Kernel Address Leakage via WARN()" by Pumpkin Chang [article]
2025: "Three bypasses of Ubuntu's unpri user namespace restrictions" by Qualys Research Team [article]
2025: "A hole in FineIBT protection" by Jonathan Corbet [article]
2024: "SELinux bypasses" [article]
2024: "Page-Oriented Programming: Sub Control-Flow Integrity of Commodity Operating System Kernels with Non-Writable 代码 Pages" by Seunghun Han et al. [paper] [slides] [video]
2024: "Defects-in-Depth: Analyzing the Integration of Effecti against One-Day Exploits in Android Kernels" by Lukas Maar et al. [paper] [artifacts]
2024: "Leaking Host KASLR from Guest Tagged TLB" by Reno Robert [article]
2024: "TikTag: Breaking ARM's Memory Tagging Extension with Speculati" by Juhee Kim et al. [paper] [代码]
2023: "A Closer Look At Freelist Hardening" by Matt Yurkewych [article] [slides]
2023: "Leaky Address Masking: Exploiting Unmasked Spectre Gadgets with Noncanonical Address Translation" [paper]
2023: "MTE As Implemented, Part 3: The Kernel" by Mark Brand [article]
2023: "Breaking Hardware-Assisted Kernel Control-Flow Integrity with Page-Oriented Programming" by Seunghun Han [slides]
2023: "EPF: E Filter" by Di Jin et al. [paper]
2023: "Bypassing SELinux with init_module" by Sean Pesce [article]
2023: "Finding Gadgets for CPU Side-Channels with Static Analysis Tools" by Jordy Zomer and Alexandra Sandulescu [article]
2023: "Linux Kernel: Spectre-v1 gadgets" by Jordy Zomer and Alexandra Sandulescu [article]
2023: "Linux Kernel: Spectre v2 SMT mitigations problem" by Eduardo Vela [article]
2022: "A Dirty Little History: Bypassing Spectre Hardware Defenses to Leak Kernel Data" [slides]
2022: "Tetragone: A Lesson in Security Fundamentals" by Pawel Wieczorkiewicz and Brad Spengler [article]
2021: "Characterizing, Exploiting, and Detecting DMA 代码 Injection in the Presence of an IOMMU" [paper]
2021: "A General Approach to Bypassing Many Kernel Protections and its Mitigation" by Yueqi Chen [slides] [video]
2021: "Attacking Samsung RKP" by Alexandre Adamski [article]
2020: "Things not to do when using an IOMMU" by Ilja and Joseph Tartaro [video]
2020: "SELinux RKP misconfiguration on Samsung S20 devices" by Nikolenko [article]
2020: "TagBleed: Breaking KASLR on the Isolated Kernel Address Space using Tagged TLBs" [paper]
2020: "Weaknesses in Linux Kernel Heap Hardening" by Sil [article]
2020: "An Analysis of Linux Kernel Heap Hardening" by Sil [article]
2020: "PAN: Another day, another broken mitigation" by Siguza [article]
2019: "KNOX Kernel Mitigation Bypasses" by Dong-Hoon You at PoC [slides]
2017: "Lifting the (Hyper) Visor: Bypassing Samsung’s Real-Time Kernel Protection" by Gal Beniamini [article]
2016: "Linux Kernel x86-64 bypass SMEP - KASLR - kptr_restric" [article]
2016: "Practical SMEP bypass techniques on Linux" by Nikolenko at KIWICON [slides]
2016: "Micro architecture attacks on KASLR" by Anders Fogh [article]
2016: "Jump Over ASLR: Attacking Branch Predictors to Bypass ASLR" by Dmitry E et al. [slides]
2016: "Prefetch Side-Channel Attacks: Bypassing SMAP and Kernel ASLR" by Daniel Gruss et al. at CCS [video]
2016: "Using Undocumented CPU Behavior to See Into Kernel Mode and Break KASLR in the Process" at Black Hat [video]
2016: "Breaking KASLR with Intel TSX" Yeongjin Jang, Sangho Lee and Taesoo Kim at Black Hat [slides] [video]
2016: "Breaking KASLR with micro architecture" by Anders Fogh [article]
2015: "Effectively bypassing kptr_restrict on Android" by Gal Beniamini [article]
2014: "ret2dir: Deconstructing Kernel Isolation" by P. Kemerlis et al. at Black Hat Europe [paper] [video]
2013: "A Linux Memory Trick" by Dan Rosenberg [article]
2011: "SMEP: What is It, and How to Beat It on Linux" by Dan Rosenberg [article]
2009: "Bypassing Linux' NULL pointer dereference exploit pre (mmap_min_addr)" [article]
Project Zero bug reports
Google kernelCTF writeups and exploits
Assorted ad by Gyorgy Miru and kutyacica
Info-leaks
2026: "From KernelSnitch to Practical msg_msg/pipe_buffer Heap KASLR Leaks" by Lukas Maar [article] [代码]
2025: "C: Kernel Pointer Leakage in Mali GPU's Timeline Stream Message Buffers" [article] [C]
2025: " in the /proc Component of the CAN BCM 协议 in the Linux kernel" by Anderson Nascimento [slides] [C] [C] [C]
2025: "Use-after-free in CAN BCM subsystem leading to information disclosure (C)" [article] [C]
2025: "KernelSnitch: Side-Channel Attacks on Kernel Data Structures" by Lukas Maar et al. [paper] [slides]
2024: "Linux vDSO & VVAR" by Pumpkin Chang [article] [C]
2024: "CPU Speculation And Mitigations in the Linux Kernel" by Pumpkin Chang [article] [Spectre V1] [Spectre V2]
2024: "Linux Kernel Meltdown Mitigation Analysis" by Pumpkin Chang [article] [Meltdown]
2024: "Out of the kernel, into the tokens" by Max Ammann and Emilio Lopez [article]
2023: "The code that wasn’t there: Reading memory on an Android device by accident" by Man Yue Mo [article] [C]
2023: "EntryBleed: A Uni KASLR Bypass against KPTI on Linux" [paper] [C]
2022: "EntryBleed: Breaking KASLR under KPTI with Prefetch (C)" [article] [C]
2022: "Yet another bug into Netfilter" by Arthur Mongodin [article] [C]
2022: "The AMD Branch (Mis)predictor: Just Set it and Forget it!" by Pawel Wieczorkiewicz [article] [Spectre]
2022: "The AMD Branch (Mis)predictor Part 2: Where No CPU has Gone Before (C)" by Pawel Wieczorkiewicz [article] [Spectre]
2021: "Samsung S10+/S9 kernel 4.14 (Android 10) Kernel Function Address (.text) and Heap Address Information Leak" [article] [C]
2021: "Linux Kernel /proc/pid/syscall information disclosure " [article] [C]
2021: "Spectre exploits in the "wild"" [article]
2021: "VDSO As A Potential KASLR Oracle" by Philip Pettersson and Alex Radocea [article]
2020: "PLATYPUS: Software-based Power Side-Channel Attacks on x86" [paper]
2019: "C / C - Analysis of Spectre Attacking Linux Kernel ebpf" [article] [C, C]
2019: "From IP ID to Device ID and KASLR Bypass (Extended )" [paper]
2018: "Kernel Memory disclosure & CANVAS Part 1 - Spectre: tips & tricks" [article] [Spectre]
2018: "Kernel Memory disclosure & CANVAS Part 2 - C analysis & exploitation notes" [article] [C]
2018: "C: Exploiting an arbitrary-read in the Linux kernel timer subsystem" by Andrey Konovalo] [C]
2017: "Linux kernel 2.6.0 to 4.12-rc4 infoleak due to a data race in ALSA timer" by Alexander Potapenko [announcement] [C]
2017: "The Infoleak that (Mostly) Wasn't" by Brad Spengler [article] [C]
2016: "Exploiting a Linux Kernel Infoleak to bypass Linux kASLR" [article]
2010: "Linux Kernel pktcd Disclosure" by Jon Oberheide [article] [C]
2009: "Linux Kernel x86-64 Register Leak" by Jon Oberheide [article] [C]
2009: "Linux Kernel getname() Stack Memory Disclosures" by Jon Oberheide [article] [C]
LPE
2026: "Route of Root: Bring a \"DoS only\" bug to LPE and bypass the existing patch to win $10,500 in kernelCTF" [article] [exploit] [C]
2026: "SCTPhantom: An 18-Year-Old SCTP ASCONF Transport Use-After-Free" [article] [C]
[2026: "[Linux RDMA/rxe] From kref_get to root: exploitation of C" by nasm]() [article] [exploit] [C]
2026: "Exploiting Mali GPU via the Dirty Pagetable on a Pixel 7 Pro" by Kuzey Arda Bulut [article] [exploit] [C]
2026: "Linux Bridge STP Timer Use-After-Free" [article] [C]
2026: "RefluXFS: Local Pri Escalation via XFS reflink direct-I/O race (C)" by Qualys Research Team [article] [C]
2026: "Frag Gap" by qwerty [article] [exploit] [C]
2026: "A Linux Kernel 0-day Journey - From a limited UAF to Physical Memory R/W" by kiks [article] [C]
2026: "I handed the epoll UAF to an agent" by Guy Beck [article] [C]
2026: IonStack part III: Rooting Android 17 with GhostLock [article] exploit] [C]
2026: IonStack part II: GhostLock, a stack-UAF that has existed in ALL Linux distributions for 15 years [article] [C]
2026: "Dissecting and Exploiting Linux LPE : DirtyClone (C)" by Eddy Tsalolikhin and Or Peles [article] [C]
2026: "19+ Years Hidden, $80,000+ Rewarded: Reporting a Linux Kernel Zero-Day for Google kernelCTF: C" by Yuki Koike and Kota Toda [article] [C]
2026: "PACKET_EDIT_MEME.c (C): yet another Page Cache Poisoning Nightmare" by Massimiliano Oldani [article] [exploit] [C]
2026: "IP: a unpri container / jail escape PoC" by Massimiliano Oldani [article] [exploit] [C]
2026: "PTRACE_MAY_DREAM: C, forgotten too soon, full privesc included" by Massimiliano Oldani [article] [exploit] [C]
2026: "Analysis and exploitation of C" by Felix [article] [C]
2026: "Unpri root via a use-after-free in DRM GEM change_handle (C)" by Stan Shaw [article] [C]
2026: "Unpri root via an out-of-bounds write in the FUSE readdir cache (C)" by Stan Shaw [article] [C]
2026: "Bad Epoll: The bug missed by Mythos" by Jaeyoung Chung [article] [C]
2026: "Exploiting C via the Page Cache" by Kuzey Arda Bulut [article] [C]
2026: "Off By !: Exploiting a Use-after-Free in the Linux Kernel" by Oli [article] [C]
2026: "CIFSwitch: a non-uni Linux local root " by Asim Oglu Manizada [article] [exploit] [C]
2026: "Copy Fail" [summary] [article] [exploit] [C]
2026: "C: Copy Fail" by Jorge Buzeti [article] [C] [Copy Fail]
2026: "Copy Fail: A 4-Byte Page-Cache Write LPE" by Axura [article] [exploit] [C] [Copy Fail]
2026: "AF_ALG page-cache cross-container pivot: Part I" by Massimiliano Oldani [article] [exploit] [C] [Copy Fail]
2026: "Copy Fail: From Pod to Host." by Juno Im [article] [exploit] [C] [Copy Fail]
2026: "Dirty Frag" by Hyunwoo Kim [article] [exploit] [C] [C] [Dirty Frag]
2026: "copy fail 2: electric boogaloo" by SiCk [article] [exploit] [C] [Dirty Frag]
2026: "Discovery and Disclosure of an RxGK in the Linux Kernel Pri Escalation Family \"Dirty Frag\"" [article] [C] [Dirty Frag]
2026: "Load-Bearing Assumptions: the rxrpc case (C) and the constraint that was ne" by Massimiliano Oldani [article] [exploit] [C] [Dirty Frag]
2026: "Fragnesia" by William Bowling [article] [] [C] [Fragnesia]
2026: "DirtyCBC: When Linux Kernel Decrypt-Before-MAC Turns Authenticated Encryption Into a Page-Cache Write" by Kamil Leoniak [article] [C] [Dirty CBC] [Dirty Decrypt]
2026: "PinTheft" by Aaron Esau [article] [C]
2026: "From Zero To Root: Attacking Qualcomm DSP Driver" by Xiling Gong [video] [C]
2026: "Tile-Based Deferred Rooting: When Your GPU Starts Rendering To Kernel 代码 Space!" by Xingyu Jin and Martijn Bogaard [slides] [video] [C]
2026: "Pri Escalation via a Page Use-After-Free in Qualcomm's AI Accelerator Linux Kernel Driver" by Lukas Maar [article] [代码] [C]
2026: "Damned OOB" by Mohamed Salem Eddah [article] [C]
2026: "Logic bug in the Linux kernel's __ptrace_may_access() function" by Qualys Research Team [article] [C]
2026: "C: Use-After-Free in the Linux Bonding Driver" by Moe Acherir [article] [C]
2026: "C, or Easy Kernel Exploitation" by Moe Acherir [article] [C]
2026: "A 0-Click Exploit Chain For The Pixel 10" by Natalie Sil and Seth Jenkins [video] [article] [C]
2026: "This Android kernel exploit is way too simple" by Billy Ellis [video] [C]
2026: "Exploring Android ROOT " [article] [C]
2026: "Codex Hacked a Samsung TV" [article] [C]
2026: "From a Netfilter Bug to kernelCTF: Exploiting C in the Linux Kernel and winning a $10500 Bounty" [article] [C]
2026: "Reproducing C: How one character can change e" [article] [C]
2026: "Assessing Claude Mythos Preview's cybersecurity capabilities" [article] [C]
2026: "kernel alchemy pt. 1: de exploit primitives with C" by hypr [article] [C]
2026: "Out-of-Cancel: A Class Rooted in Workqueue Cancellation APIs" [article] [C]
2026: "Linux Kernel C (h0mbre kCTF bug) LPE" [article] [C]
2026: "CrackArmor: Multiple in AppArmor" by Qualys Research Team [article] [C]
2026: "PageJack in Action: C exploit" by Jean [article] [C]
2026: "A Race Within A Race: Exploiting C in Linux Packet Sockets" [article] [C]
2026: "Linux Kernel net/sched CAKE Qdisc Use-After-Free LPE" by Noamr [article] [C]
[2026: "[Cryptode] Page-level UAF exploitation" by nasm]() [article] [NO-CVE]
2026: "A 0-click exploit chain for the Pixel 9 Part 2: Cracking the Sandbox with a Big Wave" by Seth Jenkins [article] [C]
2026: "Translator/Mali Utgard Hacking" [articles] [exploits] [C]
2025: "Walkthrough of an N-day Android GPU dri" by Angus [video] [C]
2025: "A tale of challenging MTE: Rooting Google Pixel with kernel MTE enabled in one shot" by Yong Wang [slides] [C]
2025: "C (Part 1) - In-the-wild Android Kernel Analysis + PoC" by Faith [article] [C]
2025: "C (Part 2) - Extending The Race Window Without a Kernel Patch" by Faith [article] [C]
2025: "C (Part 3) - Unco Chronomaly" by Faith [article] exploit [C]
2025: "Dangling pointers, fragile memory—from an undisclosed to Pixel 9 Pro pri escalation" [article] [C] [C]
2025: "Dirty Ptrace: Exploiting Undocumented Behaviors in Kernel mmap Handlers" by Xingyu Jin and Martijn Bogaard [slides] [video] [C] [C] [C] [C]
2025: "Déjà Vu in Linux io_uring: Breaking Memory Sharing Again After Generations of Fixes" by Pumpkin Chang [slides] [video] [C]
2025: "CUDA de Grâce" by Palmiotti and Samuel Lovejoy [slides] [video] [C]
2025: "An RbTree Family Drama: Exploiting a Linux Kernel 0-day Through Red-Black Tree Transformations" by Savino Dicanosa and William Liu [slides] [video] [C]
2025: "Race Condition Symphony: From Tiny Idea to Pwnie" by Hyunwoo Kim and Wongi Lee [slides] [C]
2025: "Exploiting C on a Samsung S23" by XploitBengineer [article] [C]
2025: "LPE imbalance in the af_unix of Ubuntu's Kernel" by kylebot [article] [C]
2025: "Cracking the Pixel 8: Exploiting the Undocumented DSP to Bypass MTE" by Pan Zhenpeng and Jheng Bing Jhong [slides] [video]
2025: "DirtyPipe-C" by Abdul Qadir [article] [C]
2025: "Oops! It's a kernel stack use-after-free: Exploiting NVIDIA's GPU Linux drivers" by Robin Bastide [article] [C] [C]
2025: "ksmbd - Exploiting C" by Norbert Szetei [article] [C] [exploit]
2025: "Analysing a 1-day in the Linux Kernel's TLS Subsystem" by Faith [article] [C] [exploit]
2025: "Analyze Linux Kernel 1-day 0aeb54ac" by Pumpkin Chang [article] [C]
2025: "Kernel-hack-drill and a new approach to exploiting C in the Linux kernel" by Alexander Popo] [C]
2025: "A Walk Through Android Physical Memory: C Pri Escalation" [article] [comment] [C]
2025: "netfilter: ipset: Missing Range Check LPE" [article] [C]
2025: "From Chrome renderer 代码 exec to kernel with MSG_OOB" by Jann Horn [article] [C]
[2025: "[C] Exploiting All Google kernelCTF Instances And Debian 12 With A 0-Day For $82k: An RBTree Family Drama (Part One: LTS & COS)" by D3vil]() [article] [C]
2025: "Linux Kernel Pipapo Set Double Free LPE" by Slavin and Le Premier Homme [article] [C]
2025: "The tragedy of Netfilter Tunnel: C" [article] [C]
2025: "Solo: A Pixel 6 Pro Story (When one bug is all you need)" by Lin Ze Wei [article] [C] [C]
2025: "Bypassing MTE with C" by Man Yue Mo [article] [C]
2025: "Skin in the 游戏: Survival of GPU IOMMU Irregular Damage" by Fish and Ling Hanqin [video] [C] [C] [C] [C] [C]
[2025: "[C] Two Bytes Of Madness: Pwning The Linux Kernel With A 0x0000 Written 262636 Bytes Out-Of-Bounds" by D3vil]() [article] [C]
2025: "Linux Kernel Exploitation: C: Attack of the Vsock" by Michael Hoefler [article] [C]
2025: "C nday writeup" by [article] [exploit] [C]
2025: "Exploiting C via the Dirty Pagetable Method" by Kuzey Arda Bulut [article] [C]
2025: "Kernel-Hack-Drill: En For De Linux Kernel Exploits" by Alexander Popo] [C]
2025: "Linux kernel hfsplus slab-out-of-bounds Write" by Attila Szasz [article] slides [C]
2025: "C: an OOB Write in Netfiler Ipset" by Pumpkin Chang [article] [C]
2025: "Patch-Gapping the Google Container-Optimized OS for $0" by h0mbre [article] [C]
2025: "Mali-cious Intent: Exploiting GPU (C / C)" by Ng Zhi Yang [article] [C] [C]
2025: "Introduction to Android GPU Attack and Defense" [article] [C]
2024: "The Qualcomm DSP Driver - Unexpectedly Exca an Exploit" by Seth Jenkins [article] video [C] [C] [C] [C] [C]
2024: "OtterRoot: Netfilter Uni Root 1-day" by Pedro Pinto [article] [C]
2024: "How I use a no to exploit a limited OOB on Ubuntu at Pwn2Own 2024" by Pumpkin Chang [slides] [C]
2024: "GPUAF - Two ways of Rooting All Qualcomm based Android phones" by Pan Zhenpeng and Jheng Bing Jhong [slides] [C] [C]
2024: "Breaking through the cage: Get Android uni root by B-PUAF" by Lu Yutao and Ling Hanqin [slides] [C]
2024: "Unleashing a 0day: Pi Capabilities and Conquering the Linux Kernel" by Pedro Pinto [slides] [video] [C]
2024: "Utilizing Cross-CPU Allocation to Exploit Preempt-Disabled Linux Kernel" by Mingi Cho and Wongi Lee [slides] [C] [video] [C]
2024: "1day vuln de" [video] [C]
2024: "Race conditions in Linux Kernel perf events" [代码] [C]
2024: "C (Race Condition + Use-After-Free)" by ii4gsp [article] [C]
2024: "GPUAF Using a general GPU exploit tech to attack Pixel8" by Pan Zhenpeng and Jheng Bing Jhong [slides] [video] [C]
2024: "Linux Kernel taprio OOB" [article] [C]
2024: "C Samsung npu driver" by Javier P Rufo [article] [C]
2024: "The Way to Android Root: Exploiting Your GPU On Smartphone" by Xiling Gong et al. [slides] [video] [C]
2024: "Clash, Burn, and Exploit: Manipulate Filters to Pwn kernelCTF" by HexRabbit [slides] [video] [C]
2024: "A deep dive into C: How we found and fixed an eBPF Linux Kernel " by Juan Jose Lopez Jaimez and Meador Inge [article] [C]
2024: " in the eBPF register limit tracking" by Juan Jose Lopez Jaimez [C]
2024: "Android Binder Attack Matrix" by Utkarsh [article]
[part 2]
[part 3]
[part 4]
[part 5]
2024: "Driving forward in Android drivers" by Seth Jenkins [article] [video] [C] [C]
2024: "Attacking Android Binder: Analysis and Exploitation of C" by Eugene Rodionov et al. [article] [C]
2024: "How to Fuzz Your Way to Android Uni Root: Attacking Android Binder" by Eugene Rodionov and Zi Fan Tan [slides] [video] [C]
2024: "Linux Kernel nft_ Integer O Pri Escalation" [article] [C]
2024: "游戏 of Cross Cache: Let's win it in a more effective way!" by Le Wu [slides] [video] [C]
2024: "LinkDoor: A Hidden Attack Surface in the Android Netlink Kernel Modules" by Chao Ma et al. [slides] [C] [C]
2024: "Flipping Pages: An analysis of a new Linux in nf_tables and hardened exploitation techniques" by notselwyn [article] [exploit] [C]
2024: "64 bytes and a ROP chain – A journey through nftables" by Davide Ornaghi [article] [part 2] [exploit] [C]
2024: "Mind the Patch Gap: Exploiting an io_uring in Ubuntu" by Oriol Castejon [C]
2024: "C Writeup" [article] [C]
2024: "n_gsm_exploit" [article]
2024: "The tale of a GSM Kernel LPE" [article] [exploit] [notes] [discussion]
2024: "Gaining kernel 代码 execution on an MTE-enabled Pixel 8" by Man Yue Mo [article] [exploit] [C]
2024: "Mali GPU Kernel LPE: Android 14 kernel exploit for Pixel7/8 Pro" by Mohamed Ghannam [article] [C]
2024: "C: exploiting Linux kernel N driver on Ubuntu 23.10" by rockrid3r [article] [C] [exploit]
2023: "Exploiting null-derefs" by Seth Jenkins [slides] [C]
2023: "Linux Kernel GSM Multiplexing Race Condition Local Pri Escalation (C)" by Nassim Asrir [C]
2023: "C: My file your memory" by Erin A [article] [C]
2023: "Conquering the memory through io_uring - Analysis of C" [article] [exploit] [C]
2023: "Conquering a Use-After-Free in nf_tables: Detailed Analysis and Exploitation of C" by Yordan Stoyche] [C]
2023: "One shot, Triple kill: Pwning all three Google kernelCTF instances with a single 1-day Linux " [slides] [abstract] [C]
2023: "Exploiting a bug in the Linux kernel with Zig" by Richard Palethorpe [article] [video] [C]
2023: "Escaping the Google kCTF Container with a Data-Only Exploit" by h0mbre [article] [C]
2023: "Analyzing a Modern In-the-wild Android Exploit" by Seth Jenkins [article] [C] [C]
2023: "Old bug, shallow bug: Exploiting Ubuntu at Pwn2Own 2023" by Tanguy Dubroca [article] [C]
2023: "Linux Kernel Exploit (C) with mqueue" [article] [C]
2023: "Bad io_uring: A New Era of Rooting for Android" by Zhenpeng Lin [slides] [video] [C]
2023: "C - LinkedPoll" by Querijn Voet [article] [C]
2023: "GameOver(lay): Easy-to-exploit local pri escalation in Ubuntu Linux" by Sagi Tzadik and Shir Tamari [article] [C] [C]
2023: "StackRot (C): Linux kernel pri escalation " by Ruihan Li [article] [C]
2023: "No CVE for this. It has never been in the official kernel" [article]
2023: "C exploitation userfaultfd + patching file struct etc passwd" [article] [C]
2023: "Breaking the 代码 - Exploiting and Examining C in cls_tcindex Classifier " by Vu Thi Lan [article] [C]
2023: "C - Analyzing and exploiting a bug in the udmabuf driver" [article] [C]
2023: "Rooting with root cause: finding a of a Project Zero bug" by Man Yue Mo [article] [C]
2023: "Racing Against the Lock: Exploiting Spinlock UAF in the Android Kernel" by Moshe Kol [article] [slides] [video] [exploit] [C]
2023: "Two bugs with one PoC: Roo2ng Pixel 6 from Android 12 to Android 1" by Yong Wang [slides] [C]
2023: "The O C: O, detection, and remediation" [article] [C]
2023: "Pwning Pixel 6 with a lefto" by Man Yue Mo [article] [GHSL-2023-005]
2023: "Re C" by Nils Ole Timm [article] [C]
2023: "Rooting the FiiO M6" by Jack Maginnes [article] [part 2] [video]
2023: "Exploiting C for Container Escapes" by Karsten Kyonig [article] [C]
2023: "Pwning the all Google phone with a non-Google bug" [article] [C]
2023: "C analysis and exploitation" by chenaotian [article] [C]
2022: "Escaping containers using the Dirty Pipe " by Eric Mountain et al. [article] [C]
2022: "How we use Dirty Pipe to get reverse root shell on Android Emulator and Pixel 6" by LiN and YingMuo [slides] [video] [C]
2022: "Linux kernel io_uring module pbuf_ring and pri escalation 0day" [article] [C]
2022: "C: A flaw in Netfilter leading to Local Pri Escalation" by Yordan Stoyche] [C]
2022: "C: Samsung NPU device dri free in Android" by Xingyu Jin [article] [C]
2022: "Linux Kernel: Exploiting a Netfilter Use-after-Free in kmalloc-cg" by Sergi Martinez [article] [C]
2022: "Exploiting C - Bringing back the stack attack" by Seth Jenkins [article] [C]
2022: "C: DirtyCred File Exploitation applied on an io_uring UAF" [article] [C]
2022: "DirtyCred Remastered: how to turn an UAF into Pri Escalation" [article] [C]
2022: "Exploiting cross table object reference in Linux Netfilter table (NFT) module" [slides] [C] [C]
2022: "Linux Kernel n-day exploit de" [article] [C]
2022: "Linux Kernel Exploit De: 1day case study" by Alessandro Groppo [article] [C]
[2022: "[C] A Journey To The Dawn"]() [article] [C]
2022: "A Very Powerful Clipboard: Analysis of a Samsung in-the-wild exploit chain" by Maddie Stone [article] [C] [C]
2022: "Attacking the Android kernel using the Qualcomm TrustZone" by Tamir Zaha [article] [video] [C]
2022: "SETTLERS OF NETLINK: Exploiting a limited UAF in nf_tables (C)" [article] [slides] [video] [C]
2022: "Linux Kernel Exploit (C) with mqueue" [article] [C]
2022: "N-day exploit for C: Linux kernel nft_object UAF" by Alejandro Guerrero [article] [C]
2022: "Monitoring Sur : A Deep Dive into In-the-Wild Android Full Chains in 2021" [slides] [C]
2022: "C: An io_uring " by Awarau and Da [article] [C]
2022: "Linux kernel io_uring module pbuf_ring and pri escalation 0day" [article]
2022: "Corrupting memory without memory corruption" by Man Yue Mo [article] [C]
[2022: "[C] A crack in the Linux firewall" by Arthur Mongodin]() [article] [C] [exploit]
2022: "C: netfilter analysis notes" [article] [C]
2022: "Practice of USMA-based Kernel Uni EXP Writing Ideas on C" [article] [C]
2022: "The Android kernel mitigations obstacle race" by Man Yue Mo [article] [C]
2022: "io_uring - new 代码, new bugs, and a new exploit technique" by Lam Jun Rong [article] [C]
2022: "Exploration of the Dirty Pipe (C)" by lolcads [article] [C]
2022: "DirtyPipe-Android/TECHNICAL-DETAILS.md" by polygraphene [article] [C]
2022: "Weaponizing dirtypipe on android" by Giovanni Rocca [slides] [exploit] [C]
2022: "How The Tables Ha: An analysis of two new Linux in nf_tables" by Da [C] [C]
2022: "The Discovery and Exploitation of C" by Nick Gregory [article] [C]
2022: "C: Exploit esp6 modules in Linux kernel" by ETenal [article] [C]
2022: "Put an io_uring on it: Exploiting the Linux Kernel" by Palmiotti [article] [C]
2022: "The Dirty Pipe " by Max Kellermann [article] [C]
2022: "C - Winning a $31337 Bounty after Pwning Ubuntu and Escaping Google's KCTF Containers" [article] [C]
2022: "C: Linux kernel slab out-of-bounds write: exploit and writeup" by Alejandro Guerrero [article] [C]
2022: "C: A Case Study" [article] [C]
2022: "C: Analysis and utilization and thinking and practice of new primitives for pipe" [article] [C]
2022: "Linux kernel Use-After-Free (C) PoC" [article] [C]
2022: "Exploiting C (Linux kernel) with ssh" [article] [C]
2022: "exploiting C" by cutesmilee [article] [C]
2022: "Linux Kernel PWN | 02 C" [article] [C]
2021: "Typhoon Mangkhut: One-click Remote Uni Root Formed with Two " [slides] [video] [C]
2021: "Analysis and Exploitation of C for Android Pri Escalation" by Bernard Lampe [slides] [C]
2021: "Your Trash Kernel Bug, My Precious 0-day" by Zhenpeng Lin [slides] [C]
[2021: "[C] Exploiting A 16-Year-Old In The Linux 6pack Driver"]() [article] [C]
2021: "PWN2OWN Local Escalation of Pri Category, Ubuntu Desktop Exploit" [article] [C]
2021: "Re and Exploiting Samsung's NPU" by Maxime Peterlin [article] [part 2] slides
2021: "Fall of the machines: Exploiting the Qualcomm NPU (neural processing unit) kernel driver" by Man Yue Mo [article] [C, C, C]
2021: "Exploiting C" by Blasty [article] [C]
2021: "How a simple Linux kernel memory corruption bug can lead to complete system compromise" by Jann Horn [article] [C]
2021: "SuDump: Exploiting suid binaries through the kernel" by Itai Greenhut [article] [C]
2021: "C Writeup" by HexRabbit [article] [C]
2021: "Kernel Pwning with eBPF: a Lo" by Palmiotti [article] [C]
2021: "The Art of Exploiting UAF by Ret2bpf in Android Kernel" by Xingyu Jin and Richard Neal [article] [slides] [video] [C]
2021: "Internal of the Android kernel backdoor " [article] [C]
2021: "Escape from chrome sandbox to root" [article] [C]
2021: "C" by Maher Azzouzi [article] [C]
2021: "Sequoia: A deep root in Linux's filesystem layer (C)" by Qualys Research Team [article] [C]
2021: "C: Turning \x00\x00 into 10000$" by Andy Nguyen [article] [C]
2021: "Exploitation of a double free in Ubuntu shiftfs driver (C)" by Dehors [article] [C]
2021: "C a reference counting bug which leads to local pri escalation in io_uring" [article] [C]
2021: "C: CAN ISOTP local pri escalation" [article] [C]
2021: "C: CAN BCM local pri escalation" [article] [announcement] [C]
2021: "Blue Klotski (C) and the story for fixing" by f0rm2l1n [article] [announcement] [C]
2021: "ZDI-20-1440: An Incorrect Calculation Bug in the Linux Kernel eBPF " by Lucas Leong [article]
2021: "ZDI-20-1440 Writeup" by HexRabbit [article]
2021: "SSD Ad – O PE" [article] [C]
[2021: "[BugTales] A Ner Bug Collision in Samsung's NPU Driver" by Gyorgy Miru]() [article] [C, S]
2021: "C: A Reference-Counting Bug in the Linux Kernel io_uring Subsystem" by Lucas Leong [article] [C]
2021: "One day short of a full chain: Part 1 - Android Kernel arbitrary 代码 execution" by Man Yue Mo [article] [GHSL-2020-375]
2021: "New Old Bugs in the Linux Kernel" [article] [C, C, C]
2021: "Four Bytes of Power: exploiting C in the Linux kernel" [article] [slides] [video] [C]
2021: "Improving the exploit for C in the Linux kernel to bypass LKRG" by Alexander Popo] [slides] [video]
2021: "Gaining root access in Linux using the C " by Markel Azpeitia Loiti [paper]
2021: "The curious case of C" [article] [C]
2021: "Galaxy's Meltdown - Exploiting S" [article] [C, S]
2021: "In-the-Wild Series: Android Exploits" by Mark Brand [article]
2021: "Exploiting C (Towelroot)" by Elon Gliksberg [article] [C]
2021: "C" by Maher Azzouzi [article] [C]
2020: "An iOS hacker tries Android" by Brandon Azad [article] [C, S]
2020: "Exploiting a Single Instruction Race Condition in Binder" [article] [C]
2020: "Three Dark clouds over the Android kernel" by Jun Yao [slides] [C]
2020: "Kernel Exploitation With A File System Fuzzer" [slides] [video] [C]
2020: "Finding and exploiting a bug (LPE) in an old Android phone" by Brandon Falk [stream] [part 2] [summary]
2020: "C: Pri Escalation in the Linux kernel" by Or Cohen [article] [C]
2020: "Attacking the Qualcomm Adreno GPU" by Ben Hawkes [article] [C]
2020: "TiYunZong: An Exploit Chain to Remotely Root Modern Android Devices" by Guang Gong at Black Hat [slides] [paper] [C]
2020: "Binder - Analysis and exploitation of C" by Jean-Baptiste Cayrou [article] [C]
2020: "Binder IPC and its " by Jean-Baptiste Cayrou at THCON [slides] [C, C, C, C, C]
2020: "Exploiting C - Part 2: Escalating to root" by Eloi Sanfelix and Jordan Gruskovnjak [article] [C]
2020: "A bug collision tale" by Eloi Sanfelix at OffensiveCon [slides] [video] [C]
2020: "C: Linux Kernel Pri Escalation eBPF Program " by Manfred Paul [article] [C]
2020: "Mitigations are attack surface, too" by Jann Horn [article]
2020: "C: Exploiting a Linux kernel in the V4L2 subsystem" by Alexander Popo] [slides] [C]
2020: "Multiple Kernel Affecting All Qualcomm Devices" by Tamir Zaha [article] [C, C]
2019: "C Analysis - eBPF Sign Extension LPE" by senyuuri [article] [C]
2019: "Kernel Research / mmap handler exploitation" by deshal3] [C]
2019: "Bad Binder: Android In-The-Wild Exploit" by Maddie Stone [article] [C]
2019: "Analyzing Android's C (/de UAF)" [article] [C]
2019: "Stream Cut: Android Kernel Exploitation with Binder Use-After-Free (C)" [video] [C]
2019: "C - Android kernel binder analysis" [article] [C]
2019: "Deep Analysis of Exploitable Linux Kernel " by Tong Lin and Luhai Chen at Linux Security Summit EU [video] [C, C]
2019: "Tailoring C to Achieve Root" by Grant Hernandez [article] [C]
2019: "From Zero to Root: Building Uni Android Rooting with a Type Confusion " by Wang Yong [slides] [C, WrongZone]
2019: "KARMA takes a look at offense and defense: WrongZone from exploitation to repair" [article] [C, WrongZone]
2019: "Android Binder: The Bridge To Root" by Hongli Han and Mingjian Zhou [slides] [C]
2019: "The ‘Waterdrop’ in Android: A Binder Kernel " by Hongli Han [article] [C]
2019: "An Exercise in Practical Container Escapology" by Nick Freeman [article] [C]
2019: "Taking a page from the kernel's book: A TLB issue in mremap()" by Jann Horn [article] [C]
2019: "C - Analysis of TLB in Linux Kernel" [article]
2019: "Analysis of Linux xfrm Module Cross-Border Read-Write Escalation (C)" [article] [C]
2019: "Analysis of Escalation Caused by Integer Extension of Linux ebpf Module (C)" [article] [C]
2019: "Linux kernel 4.20 BPF integer o analysis" [article]
2019: "Attacking DRM subsystem to gain kernel pri on Chromebooks" by Di Shen [slides] [video] [C]
2018: "Linux kernel 4.20 BPF integer o o and its exploitation" [article]
2018: "C: A step-by-step Linux Kernel exploitation" [article] [C]
2018: "A cache in bug in Linux memory management" by Jann Horn [article] [C]
2018: "Dissecting a 17-year-old kernel bug" by Nikolenko at be] [C, C]
2018: "SSD Ad – IRDA Linux Driver UAF" [article] [C, C]
2018: "Integer o in Linux's create_elf_tables()" [announcement] [C]
2018: "MMap – Linux Kernel" [article] [C]
2018: "Ubuntu kernel eBPF 0day analysis" [article] [C]
2018: "eBPF and Analysis of the get-rekt-linux-hardened.c Exploit for C" [article] [C]
2017: "Challenge Impossible -- Multiple Exploit On Android" by Hanxiang Wen and Xiaodong Wang [slides] [C]
2017: "C: Exploiting an out-of-bounds bug in the Linux kernel UFO packets" by Andrey Konovalo] [C]
2017: "Linux Kernel Can Lead to Pri Escalation: Analyzing C" by Krishs Patil [article] [C]
2017: "Adapting the POC for C to Other Kernels" [article] [C]
2017: "The Art of Exploiting Uncon Use-after-free Bugs in Android Kernel" by Di Shen [slides] [C, C] [video]
2017: "Exploiting C with full protections. SMEP, SMAP, and the Chrome Sandbox!" by Chris Salls [article] [C]
2017: "Exploiting C" by Federico Bento [article] [C]
2017: "Escaping Docker container using waitid() – C" by Daniel Shapira [article] [C]
2017: "LKE v4.13.x - waitid() LPE" by HyeongChan Kim [article] [C]
2017: "Exploiting on C" [article] [C]
2017: "Race For Root: The Analysis Of The Linux Kernel Race Condition Exploit" by Alexander Popo] [C]
2017: "Race For Root: The Analysis Of The Linux Kernel Race Condition Exploit" by Alexander Popo] [C]
2017: "C: exploit the race condition in the n_hdlc Linux kernel dri SMEP" by Alexander Popo] [C]
2017: "C: local pri escalation flaw in n_hdlc" by Alexander Popo] [C]
2017: "Dirty COW" [summary] [exploit] [C]
2017: "Dirty COW and why lying is bad even if you are the Linux kernel" [article] [C]
2017: "NDAY-2017-0103: Arbitrary kernel write in sys_oabi_epoll_wait" by Zuk A [article] [C]
2017: "NDAY-2017-0106: Ele of Pri in NVIDIA n driver" by Zuk A [article] [C]
2017: "PWN2OWN 2017 Linux kernel pri escalation analysis" [article] [C]
2017: "Exploiting the Linux kernel sockets" by Andrey Konovalo] [C]
2017: "Solving a post exploitation issue with C" [article] [C]
2017: "NDAY-2017-0105: Ele of Pri in MSM Thermal Drive" by Zuk A [article] [C]
2017: "NDAY-2017-0102: Ele of Pri in NVIDIA Video Driver" by Zuk A [article] [C]
2017: "C: Exploiting a double-free in the Linux kernel DCCP sockets" by Andrey Konovalo] [C]
2016: "C Linux af_packet.c race condition (local root)" by Philip Pettersson [announcement] [C]
2016: "Rooting Every Android From Extension To Exploitation" by Di Shen and James Fang at Black Hat [slides] [article] [C, C, C, C]
2016: "Talk is Cheap, Show Me the 代码" by James Fang et al. [slides] [C]
2016: "C: Arbitrary Kernel Write in Nexus 9" by Sagi Kedmi [article] [C]
2016: "Exploiting Recursion in the Linux Kernel" by Jann Horn [article] [C]
2016: "ANALYSIS AND EXPLOITATION OF A LINUX KERNEL (C)"` [article] [C]
2016: "C Exploit 代码 Explained" by Shilong Zhao [article] [C]
2016: "C " by Collin Mulliner [article] [C]
2016: "Notes about C" by Lizzie Dixon [article] [C]
2016: "C: exploiting a double-free in the usb-midi linux kernel driver" by Andrey Konovalo] [C]
2016: "C: Exploiting Linux kernel heap off-by-one" by Nikolenko [article] [C]
2016: "C group_info UAF Exploitation" by Nikolenko [article] [C]
2016: "Perf: From Profiling To Kernel Exploiting" by Wish Wu at HITB Ams [slides] [video] [C]
2016: "QUADROOTER: NEW AFFECTING OVER 900 MILLION ANDROID DEVICES" [article] [C, C, C, C]
2016: "STUMPING THE MOBILE CHIPSET: New 0days from down under" by Adam Donenfeld at DEF CON [slides] [C, C, C, C]
2015: "Android linux kernel pri escalation and exploit (C)" by Gal Beniamini [article] [C]
2015: "Exploiting "BadIRET" " by Rafal Wojtczuk [article] [C]
2015: "Follow-up on Exploiting "BadIRET" (C)" by Adam Zabrocki [article] [C]
2015: "Ah! Uni Android Rooting Is Back" by Wen Xu at Black Hat [slides] [video] [paper] [C]
2015: "When is something o" by Keen Team [slides]
2015: "Exploiting the DRAM rowhammer bug to gain kernel pri" by Mark Seaborn and Thomas Dullien [article] [Rowhammer]
2015: "C - PPPoL2TP DoS Analysis" by Nikolenko [article] [C]
2015: "C: Use-After-Free in the Camera Driver of Qualcomm MSM 7x30" [article] [C]
2014: "Exploiting C a walk-through of the Linux pty race condition PoC" by Samuel Gross [article] [C]
2014: "C: Linux Kernel Local Pri Escalation "exploitation"" by Nikolenko [article] [C]
2014: "C: Linux Kernel ptrace/sysret analysis" by Nikolenko [article] [C]
2014: "How to exploit the x32 recvmmsg() kernel C" by Samuel Gross [article] [C]
2014: "Exploiting the Futex Bug and unco Towelroot" [article] [C]
2014: "C Exploit" by Joel Eriksson [article] [C]
2013: "Pri Escalation Kernel Exploit" by Julius Plenz [article] [C]
2013: "A closer look at a recent pri escalation bug in Linux (C)" by Joe Damato [article] [C]
2012: "Linux Local Pri Escalation via SUID /proc/pid/mem Write" by Jason Donenfeld [article] [C]
2011: "Kernel Exploitation Stack" by Kees Cook at DEF CON [slides] [video] [C]
2010: "C v4l compat exploit" by Kees Cook [article] [C]
2010: "Exploiting large memory management in Xorg ser on Linux" by Rafal Wojtczuk [article] [C]
2010: "C: The Anatomy of a Kernel Exploit" by Nelson Elhage [article] [C]
2010: "Linux Kernel CAN SLUB O" by Jon Oberheide [article] [C]
2010: "af_can linux kernel o" by Ben Hawkes [article] [C]
2010: "linux compat vulns (part 1)" by Ben Hawkes [article] [C]
2010: "linux compat vulns (part 2)" by Ben Hawkes [article] [C]
2010: "Some Notes on C Exploitability" [article] [C]
2010: "Anatomy of an exploit: C" [article] [C]
2010: "C: Turning denial-of-service into pri escalation" by Nelson Elhage [article] [C]
2009: "Linux NULL pointer dereference due to incorrect proto_ops initializations (C)" [article] [C]
2009: "Even when one byte matters" [article] [C]
2009: "C/C: Linux kernel (2) Pri Escalation" [article] [C, C]
2008: "(): the making of a local root exploit" by Jonathan Corbet [article] [C]
2004: "Linux kernel do_mremap local pri escalation " [article] [C]
RCE
2026: "From breaking into my ISP router to finding a MediaTek kernel 0day" by Fresco [article] [C] [C] [C]
2025: "Eternal-Tux: Crafting a Linux Kernel KSMBD 0-Click RCE Exploit from N-Days" by William Liu [article] [C] [C]
2024: "Listen Up: Sonos O Remote Kernel Exploitation and Covert Wiretap" by Robert Herrera and Alex Plaskett [article] [slides] [video] [C] [C]
2023: "Abusing Linux In-Kernel SMB 服务端 to Gain Kernel Remote 代码 Execution" by Guillaume Teissier and Quentin Minster [video] [C] [C]
2022: "Writing a Linux Kernel Remote in 2022" by Samuel Page [article] [slides] [C]
2022: "Zenith: Pwn2Own TP-Link AC1750 Smart Wi-Fi Router Remote 代码 Execution " by Axel Souchet [article] [C]
2021: "BleedingTooth: Linux Bluetooth Zero-Click Remote 代码 Execution" by Andy Nguyen: BadChoice, BadKarma, BadVibes [article] [C, C, C]
2017: "Over The Air: Exploiting Broadcom’s Wi-Fi Stack (Part 2)" by Gal Beniamini [article] [C]
2017: "BlueBorn: The dangers of Bluetooth implementations: Un zero day and security flaws in modern Bluetooth stacks" [paper] [C]
2016: "C: C" by Eyal Itkin [article] [C]
2011: "Owned O Radio: Remote Kernel Exploitation in 2011" at DEF CON [slides] [video] [C]
2009: "When a "potential D.o.S." means a one-shot remote kernel exploit: the SCTP story" [article] [C]
KVM
2026: "I found a K heap corruption bug and someone else got there first" by Himanshu Anand [article] [C]
2026: "Zapscape: Guest-to-Host Escape in KVM/x86" by Hyunwoo Kim [article] [C]
2026: "Januscape: Guest-to-Host Escape in KVM/x86" by Hyunwoo Kim [article] [C]
2026: "Bounding against the wrong buffer: an OOB read/write in K (C)" by Stan Shaw [article] [C]
2026: "ITScape: Guest-to-Host Escape in K" by Hyunwoo Kim [article] [C]
2026: "When the bug is real but the path isn't: ITScape (C) and the case for minimal runtimes" by Anastassios Nanos [article] [C]
2021: "An EPYC escape: Case-study of a K" by Felix Wilhelm [article] [C]
Other
2026: "Gone in 60 Frames - USB Video Exploitation" by Alex Plaskett and Robert Herrera [article] [slides]
2026: "Tesla IVI with Raspberry Pi Devices to bypass KASLR" by Alex Plaskett and Robert Herrera [article]
2026: "I discovered a in the Linux Kernel USB Stack" by Danilo Erazo [video] [C]
2026: "rtl8723bs — WiFi Heap O in the Linux Kernel" by Alexandru Hossu [article] [C] [C] [C] [C] [C] [C] [C] [C]
2026: "futex: remo stack uaf" by Guy Beck [article] [C]
2026: "The futex READ_ONCE" by Guy Beck [article] [C]
2026: "The epoll uaf" by Guy Beck [article] [C]
2026: "Unix GC Remastered" by Moe Acherir [article] [C]
2026: "Discovery & in the Linux Kernel (Part 1): CAN Use-After-Free Race" by Samuel Page [article]
2026: "Discovery & in the Linux Kernel (Part 2): FUSE Page Cache O" by Samuel Page [article]
2026: "My First CVE - C - io uring resize and taskrun race condition" [article] [C]
2026: "TTLM Parsing in WiFi/mac8021 one-byte look past (o)" by Ruikai Peng [article] [C]
2025: "Glitching Google's T From Adb To Root" by Niek Timmers [slides] [video] [NO-CVE]
2025: "mediatek? more like media-rekt, amirite." by hypr [article]
2025: "Dissecting a 1-Day in Linux's XFRM Subsystem" by Shreyas Penkar [article] [C] [trigger]
2025: "A Quick Note on C" by Pumpkin Chang [article] [C]
2025: "Fast & Faulty - A Use After Free in KGSL Fault Handling" by Shreyas Penkar [article] [C]
2025: "Race Against Time in the Kernel’s Clockwork" by Shreyas Penkar [article] [C]
2025: "Analysis of C, an UAF in Linux KTLS" by Pumpkin Chang [article] [C]
2025: "ZDI-25-310: Remote NULL Deref in Linux KSMBD" by Sla [article] [C]
2025: "C - Use-after-free in the TCP subsystem of the Linux kernel" [article] [C]
2025: "Simply Analyzing Two N_GSM " by Pumpkin Chang [article] [C]
2025: "A Quick Note On Two mempolicy " by Pumpkin Chang [article] [C] [C]
2025: "The E of Dirty COW" by Pumpkin Chang [article] [part 2] [C] [C] [C]
2025: "A Quick Note on C" by Pumpkin Chang [article] [C]
2025: "A Series of io_uring pbuf " by Pumpkin Chang [article] [C] [C] [C]
2025: The io_uring Promotion in kernelCTF And Two Analysis [article] [C] [C]
2025: "Linux Kernel Some Vsock Analysis" by Pumpkin Chang [article] [C] [C] [C]
2025: "From Zero to Emo – My Journey of Many Failures in kernelCTF" by Pumpkin Chang [article] [C] [C] [C]
2025: "A 1-day a Day in the Lunar New Year" by Pumpkin Chang [article] [C]
2025: "Memory-related C in kernelCTF" by Pumpkin Chang [article] [C] [C]
2025: "Two 网络-related Analysis" by Pumpkin Chang [article] [C] [C]
2025: "Cellebrite zero-day exploit used to target phone of Serbian student activist" [article] [C] [C] [C] [note 1] [note 2] [note 3] [note 4] [note 5] [note 6] [note 7]
2025: "Accidentally unco a se old in the Linux kernel" by Anderson Nascimento [article] [C]
2025: "Linux Kernel: Out of bounds Write in ksmbd_" by Jordy Zomer [article] [C]
2025: "Linux Kernel: Out of bounds Read in ksmbd_" by Jordy Zomer [article] [C]
2025: "Linux Kernel: Integer O in eBPF XSK map_delete_elem Leads to Out-of-Bounds" by Jordy Zomer [article] [C]
2025: "Integer O in eBPF DEVMAP map_delete_elem Leads to Out-of-Bounds" by Jordy Zomer [article] [C]
2025: "Some Casual Notes for C" by Pumpkin Chang [article] [C]
2024: "Linux Kernel ICMPv6 & C" by Pumpkin Chang [article] [C]
2024: "Linux Kernel Perf C Quick Analysis" by Pumpkin Chang [article] [C]
2024: "A Quick Note for Perf C" by Pumpkin Chang [article] [C]
2024: "Linux Kernel Perf C Analysis" by Pumpkin Chang [article] [C]
2024: "Linux Kernel Vsock 1-day Analysis" by Pumpkin Chang [article] [C]
2024: "Three Linux net/sched 1-day Analysis" by Pumpkin Chang [article] [C] [C]
2024: "Two Linux net/sched 1-day Analysis" by Pumpkin Chang [article] [C]
2024: "C - Linux net/sched UAF 1-day Analysis" by Pumpkin Chang [article] [C]
2024: "Linux eBPF Design and Case Study" by Pumpkin Chang [article] [part 2] [C] [C] [C]
2024: "Linux Kernel: TOCTOU in Exec System" by Marco [article] [C]
2024: "C Analysis" by Maher Azzouzi [article] [C]
2024: "C: Samsung m2m1shot_scaler0 device driver page use-after-free in Android" [article] [C]
2024: "Deep Dive into RCU Race Condition: Analysis of TCP-AO UAF (C)" [article] [C]
2024: "ZDI-24-821: A Remote UAF in The Kernel's net/tipc" by Sam Page [article] [ZDI-24-821] [C]
2024: "Race condition in 9p file system" [article]
2024: "Notes about ZDI-24-195 in ksmbd" [thread] [ZDI-24-195]
2024: "PowerVR GPU - GPU Firmware may o arbitrary kernel pages by RGXCreateFreeList" [report]
2024: "PowerVR GPU - UAF race conditon by De and De" [report]
2023: "Ubuntu Shiftfs: Unbalanced Unlock Exploitation Attempt" by Jean-Baptiste Cayrou [slides] [C]
2023: "Attacking NPUs of Multiple Platforms" [slides] [C] [C] [S] [C] [C]
2023: "Deep Di MSM Linux Kernel & ARM Mali GPU 0-day Exploit Attacks of October 2023" by Alisa Esage [article] [C] [C] [C] [C] [C]
2023: "Unleashing ksmbd: remote exploitation of the Linux kernel (ZDI-23-979, ZDI-23-980)" by notselwyn [article] [C] [C] [exploits]
2023: "C: a in the Linux exFAT driver" by Maxim Suhano] [C]
2023: "Linux IPv6 'Route of Death' 0day" by Max ] [C]
2022: "Linux Kernel: Infoleak in Bluetooth L2CAP Handling" [ad] [C]
2022: "Linux Kernel: UAF in Bluetooth L2CAP Handshake" [ad] [C]
2022: " Details for C" [article] [C]
2022: "Racing Cats to the Exit: A Boring Linux Kernel Use-After-Free" [article]
2022: "Android Uni Root: Exploiting xPU Drivers" [slides] [C] [C]
2022: "The quantum state of Linux kernel garbage collection C (Part I)" by Xingyu Jin [article] [C]
2022: "Finding bugs in the Linux Kernel Bluetooth Subsystem" by Itay Iellin [article] [part 2]
2022: "C: A Remote Stack O in The Linux" by Samuel Page [article] [C]
2022: "C | NetUSB RCE Flaw in Millions of End User Routers" by Max [article] [C]
2021: "C: refcount increment on mid-destruction file" by Jann Horn [article] [C]
2021: "Achieving Linux Kernel 代码 Execution Through a Malicious USB Device" by Martijn Bogaard and Dana Geist [slides] [C]
2021: "SLUB o C" [article] [C]
2021: "C: Fuzzing and exploitation of a use-after-free in the Linux kernel TEE subsystem" by pjlantz [article] [poc] [C]
2021: "C: Remote Linux Kernel Heap O | TIPC Module Allows Arbitrary 代码 Execution" by Max [article] [C]
2021: "C: Qualcomm Adreno GPU memory mapping use-after-free" by Ben Hawkes [article] [C]
2021: "A foray into Linux kernel exploitation on Android" by Ayaz Mammado]
2020: "C" [article] [C]
2020: "The short story of 1 Linux Kernel Use-After-Free bug and 2 CVEs (C and C)" by Adam Zabrocki [article] [C, C]
2020: "Curiosity around 'exec_id' and some problems associated with it" by Adam Zabrocki [article]
2020: "The ne problems of local ASLR holes in Linux" [article] [C]
2019: "Binder Secctx Patch Analysis" by Jean-Baptiste Cayrou [article] [C]
2019: "Re Broadcom wireless chipsets" by Hugues Anguelko] [C, C]
2019: "C - Android kernel binder analysis" [article] [C]
2019: "Linux: address 0 is mappable write() to /proc/\*/mem" [article] [C]
2019: "C - Analysis of Linux Kernel User Space 0 Address Mapping " [article] [C]
2018: "IOMMU-resistant DMA attacks" by Gil Kupfer [thesis]
2017: "initroot: Bypassing Nexus 6 Secure Boot through Kernel Command-line Injection" [article] [C]
2016: "Motorola Android Bootloader Kernel Cmdline Injection Secure Boot Bypass" [article] [C]
2015: " in the Linux Crypto API that allows unpri users to load arbitrary kernel modules" by Mathias Krause [announcement]
Finding Bugs
2026: "Concurrency Fuzzing of the Linux Kernel with eBPF" by Jiacheng Xu et al. [paper]
2026: "Fuzzing under the ca bugs in batman-adv" by Alexis and Lyes [article]
2026: "Testing race conditions with memory access tracing and stack-based delay injection" by Jann Horn [article] [代码]
2026: "Fuzzing the NVIDIA GPU Drivers" by Chiara K [article]
2026: "Static Detection of TOCTOU Bugs Caused by Kernel Races" by 界面-Dong Han et al. [paper]
2026: "Go Big or Go Home: Scaling Automatic Triaging to the Linux Kernel" [article]
2026: "Getting LLMs Drunk to Find Remote Linux Kernel OOB Writes (and More)" by Asim Oglu Manizada [article]
2026: "StepStone: LLM-Based GPU Kernel Dri Libraries" by Xiaochen Zou et al. [paper] [代码]
2026: "Discovery & in the Linux Kernel (Part 3): Local Models" by Samuel Page [article]
2026: "Memory Safety in Linux Device Drivers: Enhancing Security with Formal " by Janislley O. Sousa et al. [paper]
2026: "Reproducing a syzbot Bug in 5 Minutes — Now with !" by Roman Storozhenko [slides] [video]
2025: "Head First Reporting of Linux Kernel CVEs: Practical Use of the Kernel Fuzzer" by Yunseong Kim [slides] [video]
2025: "Build a Fake Phone, Find Real Bugs" by Romain Malmain [video] [代码]
2025: "A Modular Approach To Power Management Fuzzing" [slides] [video]
2025: "KFuzzTest: Targeted Fuzzing of Internal Kernel Functions" by Ethan Graham [slides] [video]
2025: "SYZOS: Practical K" by Alexander Potapenko [slides] [video]
2025: "DNAFuzz: Descriptor-Aware Fuzzing for USB Drivers" [paper]
2025: "Slice: SAST + LLM Interprocedural Context Extractor" by Caleb Gross [article]
2025: "KNighter: Transforming Static Analysis with LLM-Synthesized Checkers" [paper] [代码]
2025: "SyzSpec: Specification Generation for Linux Kernel Fuzzing Symbolic Execution" [paper]
2025: "Lucid Dreams I: Lucid's First Time Fuzzing" by h0mbre [article] [part 2]
2025: "A Syzkaller Summer: Fixing False Positive Soft Lockups in net/sched Fuzzing" by William Liu [article]
2025: "MCP AI agents for the Linux kernel de" by Sabyrzhan Tasbolato] [代码]
2025: "Bypassing Kernel Barriers: Fuzzing Linux Kernel in Userspace with LKL" by Eugene Rodionov and Xuan Xing [slides] [video] [代码]
2025: "Fuzzing Linux Kernel Modules" by Sla [video] [代码]
2025: "How I used o3 to find C, a remote zeroday in the Linux kernel’s SMB implementation" by Sean Heelan [article] [note]
2025: "Statically Disco Use-After-Free in the Linux Kernel" by Hang Zhang et al. [paper] [slides] [video]
2025: "Unlocking Low Frequency Syscalls in Kernel Fuzzing with Dependency-Based RAG" [paper] [代码]
2025: "External fuzzing of Linux kernel USB drivers with syzkaller" by Andrey Konovalo] [C]
2025: "A Little Goes a Long Way: Tuning Configuration Selection for Continuous Kernel Fuzzing" by Sanan Hasanov et al. [paper]
2025: "A Survey of Fuzzing Open-源码 Operating Systems" [paper]
2025: "SoK: Unra the Veil of OS Kernel Fuzzing" [paper]
2025: "SyzParam: Incorporating Runtime Parameters into Kernel Dri" [paper]
2025: "ksmbd research" by Norbert Szetei [article]
2025: "ksmbd - Fuzzing Impro and Discovery (2/3)" by Norbert Szetei [article]
2025: "Unco New Classes of Kernel " by Jakob Koschel [thesis]
2024: "CountDown: Refcount-guided Fuzzing for Exposing Temporal Memory Errors in Linux Kernel" by Shuangpeng Bai et al. [paper]
2024: "Hunting Bugs in Linux Kernel With KASAN: How to Use it & What's the Benefit?" by Sla [article]
2024: "Finding Bugs in Kernel" by Sla [article] [part 2]
2024: "OZZ: Identifying Kernel Out-of-Order Concurrency Bugs with In- Reordering" by Dae R. Jeong et al. [paper]
2024: "Fuzzing the EBPF Subsystem" by Zac Ecob [video]
2024: "Finding Bugs in Kernel. Part 1: Crashing a Driver with Syzkaller" by Moskvin [article]
2024: "Lessons from the buzz" by Juan Jose Lopez Jaimez [slides] [video]
2024: "The State of eBPF Fuzzing" by Paul Chaignon [slides] [video]
2024: "CARDSHARK: Understanding and Stablizing Linux Kernel Concurrency Bugs Against the Odds" [paper]
2024: "LR-Miner: Static Race Detection in OS Kernels by Mining Locking Rules" by Tuo Li et al. [paper]
2024: "Detecting Kernel Memory Bugs through Inconsistent Memory Management Intention Inferences" [paper] [slides]
2024: "MOCK: Optimizing Kernel Fuzzing Mutation with Context-aware Dependency" [paper]
2024: "SyzGen++: Dependency Inference for Augmenting Kernel Dri" [paper]
2024: "StateFuzz: System Call-Based State-Aware Linux Dri" by Bodong Zhao et al. [paper] [代码]
2024: "BRF: eBPF Runtime Fuzzer" by Hsin-Wei Hung and Ardalan Amiri Sani [paper]
2024: "So You Wanna Find Bugs In The Linux Kernel?" by Sam Page [slides]
2024: "A bug hunter's reflections on fuzzing" by Alexander Popo] [video]
2024: "To Boldly Go Where No Fuzzer Has Gone Before: Finding Bugs in Linux’ Wireless Stacks through Devices" by Sonke Huster et al. [paper] [代码]
2024: "Your NVMe Had Been Syz’ed: Fuzzing N/TCP Driver for Linux with Syzkaller" by Alon Zavahi [article] [slides] [video]
2024: "Structure-Aware linux kernel Fuzzing with libFuzzer" [article]
2024: "Enhancing Kernel Bug Discovery with Large Language Models" by Zahra Tarkhani [slides] [video]
2024: "SyzRisk: A Change-Pattern-Based Continuous Kernel Regression Fuzzer" [paper]
2024: "SyzBridge: Bridging the Gap in Exploitability Assessment of Linux Kernel Bugs in the Linux Ecosystem" [paper]
2024: "SyzRetrospector: A Large-Scale Retrospecti of Syzbot" [paper]
2023: "ReUSB: Replay-Guided USB Dri" by Jisoo Jang et al. [paper] [slides] [video]
2023: "SyzGPT: When the fuzzer meets the LLM" by Erin A [article]
2023: "KernelGPT: Enhanced Kernel Fuzzing Language Models" [paper]
2023: "SyzDirect: Directed Greybox Fuzzing for Linux Kernel" [paper]
2023: "Using ASAN and KASAN and then Interpreting their shadow memory reports" by Kaiwan N Billimoria [article]
2023: "GWP-ASan: Sampling-Based Detection of Memory-Safety Bugs in Production" [paper]
2023: "Tickling ksmbd: fuzzing SMB in the Linux kernel" by notselwyn [article]
2023: "DDRace: Finding Concurrency UAF in Linux Drivers with Directed Fuzzing" [paper] [slides]
2023: "BoKASAN: Binary-only Kernel Address Sanitizer for Effecti Fuzzing" [paper] [slides] [artifacts]
2023: "FirmSolo: Enabling dynamic analysis of binary Linux-based IoT kernel modules" [paper] [slides]
2023: "ACTOR: Action-Guided Kernel Fuzzing" [paper] [slides] [artifacts]
2023: "UNCONTAINED: Unco Container Confusion in the Linux Kernel" by Jakob Koschel et al. [paper]
2023: "KIT: Testing OS-Le for Functional Interference Bugs" [paper]
2023: "SyzDescribe: Principled, Automated, Static Generation of Syscall Descriptions for Kernel Drivers" [paper] [slides]
2023: "Precise Detection of Kernel Data Races with Probabilistic Lockset Analysis" [paper]
2023: "No Grammar, No Problem: Towards Fuzzing the Linux Kernel without System-Call Descriptions" [paper]
2023: "FirmSolo: Enabling dynamic analysis of binary Linux-based IoT kernel modules" [paper]
2022: "E Fuzzing, Patch-based Research, and Comment Police: Finding Bugs Through a Bug" [slides] [video]
2022: "Breaking the Glass Sandbox - Find Linux Kernel Bugs and Escape" by Palmiotti at REcon [slides] [video]
2022: "Sanitizing the Linux kernel: On KASAN and other Dynamic Bug-finding Tools" by Andrey Konovalo] [video] [article]
2022: "PrIntFuzz: Fuzzing Linux Drivers Device Simulation" [paper]
2022: "KSG: Augmenting Kernel Fuzzing with System Call Specification Generation" [paper]
2022: "Demystifying the Dependency Challenge in Kernel Fuzzing" [paper]
2022: "Hunting for Linux kernel public " [article]
2022: "DangZero: Efficient Use-After-Free Detection Page Table Access" [paper]
2022: "How I started chasing speculative type confusion bugs in the kernel and ended up with 'real' ones" by Jakob Koschel [slides] [video]
2022: "Technical analysis of syzkaller based fuzzers: It's not about !" [article]
2022: "GREBE: Un Exploitation Potential for Linux Kernel Bugs" [paper]
2022: "An In-depth Analysis of Duplicated Linux Kernel Bug Reports" [paper]
2022: "Looking for Remote 代码 Execution bugs in the Linux kernel" by Andrey Konovalo]
2022: "Progressi: Incremental Detection of UBI bugs in the Linux Kernel" [paper]
2022: "Syzkaller diving 01: Learn basic KCOV and how fuzzer adopts it" by f0rm2l1n [article]
2022: "Syzkaller diving 02: How syzkaller describe syscalls" by f0rm2l1n [article]
2022: "Syzkaller diving 03: What is the remote KCOV?" by f0rm2l1n [article]
2022: "Case Studies of Fuzzing with Xen" by Tamas K Lengyel at OffensiveCon [slides]
2021: "Rtkaller: State-aware Task Generation for RTOS Fuzzing" [paper]
2021: "BSOD: Binary-only Scalable fuzzing Of device Drivers" by Fabian Toepfer and Dominik Maier [paper]
2021: "LinKRID: Imbalance Reference Counting in Linux kernel with Symbolic Execution" at USENIX [paper] [slides]
2021: "An Analysis of Speculative Type Confusion in the Wild" at USENIX [paper] [slides] [video]
2021: "SyzVegas: Beating Kernel Fuzzing Odds with Reinforcement Learning" at USENIX [paper] [slides] [video]
2021: "Detecting Kernel Refcount Bugs with Two-Dimensional Consistency Checking" at USENIX [paper] [slides] [video]
2021: "Ruffling the penguin! How to fuzz the Linux kernel" by Andrey Konovalov and xakep.ru [article]
2021: "CoLaFUZE: Co and Layout-Aware Fuzzing for Android Drivers" [paper]
2021: "C: Audit Kernel Sources for Missing C" by Denis Efremo] [video]
2021: "Finding Multiple Bug Effects for More Precise Exploitability Estimation" by Zhenpeng Lin and Yueqi Chen [slides] [video]
2021: "Triaging Kernel Out-Of-Bounds Write " by Weiteng Chen [slides] [video]
2021: "SyzScope: Re High-Risk Security Impacts of Fuzzer-Exposed Bugs" by Xiaochen Zou [paper] [slides] [video] [lwn article]
2021: "HEALER: Relation Learning Guided Kernel Fuzzing" [paper]
2021: "Snowboard: Finding Kernel Concurrency Bugs through Systematic Inter-thread Communication Analysis" [paper]
2021: "Detecting semantic bugs using differential fuzzing" by Mara Mihali [slides] [video]
2021: "Fuzzing Linux with Xen" by Tamas K Lengyel [slides] [video]
2021: " analysis of the ‘Sequoia’ bug" by Jordy Zomer [article]
2021: "KMSAN, a look under the hood" by Alexander Potapenko [slides] [video]
2021: "Detecting Kernel Memory Leaks in Specialized Modules with Ownership Reasoning" [paper]
2021: "Understanding and Detecting Disordered Error Handling with Precise Function Pairing" [paper]
2021: "KFENCE - Detecting memory bugs in production kernels" [article]
2021: "Fuzzing the Linux Kernel" by Andrey Konovalo] [video]
2021: "Dynamic program analysis for fun and profit" by Dmitry [slides] [video]
2020: "UBITect: A Precise and Scalable Method to Detect Use-before-Initialization Bugs in Linux Kernel" [paper]
2020: "RetroWrite: Statically Instrumenting COTS Binaries for Fuzzing and Sanitization" [paper] [工具]
2020: "Fuzzing a Pixel 3a Kernel with Syzkaller" by senyuuri [article]
2020: "Fuzzing the Berkeley Packet Filter" by Benjamin Curt Nilsen [thesis]
2020: "syzkaller: Ad in Continuous Co Kernel Fuzzing" by Dmitry at BlueHat IL [video]
2020: "syzkaller / sanitizers: status update" by Dmitry at Linux Plumbers [slides] [video]
2020: "Fuzzing for eBPF JIT bugs in the Linux kernel" by Simon Scannell [article]
2020: "Specification and in the field: Applying formal methods to BPF just-in-time compilers in the Linux kernel" [paper]
2020: "Eliminating bugs in BPF JITs using automated formal " by Luke Nelson [video] [slides]
2020: "Fuzzing the Linux kernel (x86) entry 代码, Part 1 of 3" by Nossum [article]
2020: "Fuzzing the Linux kernel (x86) entry 代码, Part 2 of 3" by Nossum [article]
2020: "Fuzzing the Linux kernel (x86) entry 代码, Part 3 of 3" by Nossum [article]
2020: "Data-race detection in the Linux kernel" by Marco Elver at Linux Plumbers [slides] [video]
2020: "harbian-qa: State-based target directed fuzzer based on syzkaller" [article]
2020: "Agamotto: Accelerating Kernel Dri with Lightweight Machine Checkpoints" [paper] [slides] [video] [代码]
2020: "Using syzkaller, part 1: Fuzzing the Linux kernel" by Andre Almeida [article]
2020: "Using syzkaller, part 2: Detecting programming bugs in the Linux kernel" by Andre Almeida [article]
2020: "Using syzkaller, part 3: Fuzzing your changes" by Andre Almeida [article]
2020: "Using syzkaller, part 4: Dri" by Andre Almeida [article]
2020: "Effecti of Sleep-in-atomic-context Bugs in the Linux Kernel" [paper]
2020: "KRACE: Data Race Fuzzing for Kernel File Systems" [paper] [video]
2020: "USBFuzz: A 框架 for Fuzzing USB Drivers by Device Emulation" by Hui Peng and Mathias Payer [paper]
2020: "HFL: Hybrid Fuzzing on the Linux Kernel" [paper]
2020: "KOOBE: Towards Facilitating Exploit Generation of Kernel Out-Of-Bounds Write " [paper]
2020: "Analyzing the Linux Kernel in Userland with AFL and KLEE" [article]
2020: "Precisely Characterizing Security Impact in a Flood of Patches Rule Comparison" [paper] [slides] [video]
2020: "Finding Race Conditions in Kernels: from Fuzzing to Symbolic Execution" by Meng Xu [thesis]
2020: "A Hybrid Interface Recovery Method for Android Kernels Fuzzing" [paper]
2019: "perf fuzzer: Exposing Kernel Bugs by Detailed Fuzzing of a Specific System Call (2019 Update)" by M. Weaver and Da [paper]
2019: "Industry Practice of Co Enterprise Linux Kernel Fuzzing" [paper]
2019: "Effecti Analysis of Concurrency Use-After-Free Bugs in Linux Device Drivers" [paper]
2019: "A gentle introduction to Linux Kernel fuzzing" by Marek Majkowski [article]
2019: "Unicorefuzz: On the of Emulation for Kernelspace Fuzzing" [paper]
2019: "Case study: Searching for a pattern in the Linux kernel" by Alexander Popo]
2019: "Razzer: Finding Kernel Race Bugs through Fuzzing" [video] [paper]
2019: "Fuzzing File Systems Input Space Exploration" [paper] [fuzzer]
2019: "PeriScope: An Effecti and Fuzzing 框架 for the Hardware-OS Boundary" [paper]
2019: "Hourglass Fuzz: A Quick Bug Hunting Method" [slides]
2019: "Detecting Missing-Check Bugs and Context-Aware Criticalness and Constraints Inferences" [paper] [slides]
2019: "Automatically Identifying Security Checks for Detecting Kernel Semantic Bugs" [paper]
2018: "FastSyzkaller: Improving Fuzz Efficiency for Linux Kernel Fuzzing" [paper]
2018: "Writing the worlds worst Android fuzzer, and then improving it" by Brandon Falk [article]
2018: "From Thousands of Hours to a Couple of Minutes: Towards Automating Exploit Generation for Arbitrary Types of Kernel " [slides] [paper]
2018: "MoonShine: Optimizing OS Fuzzer Seed Selection with Trace Distillation" [paper] [代码]
2018: "Detecting Kernel Memory Disclosure with x86 Emulation and Taint Tracking" by Mateusz Jurczyk [paper]
2018: "New Compat In Linux Device Drivers" at BlackHat [slides]
2018: "Precise and Scalable Detection of Double-Fetch Bugs in OS Kernels" [paper]
2018: "Concolic Testing for Kernel Fuzzing and Discovery" by Nikolenko at OffensiveCon [video]
2018: "K-Miner: Unco Memory Corruption in Linux" [paper]
2017: "KernelMemorySanitizer (KMSAN)" by Alexander Potapenko [slides]
2017: "The android discovery in SoC" by Yu Pan and Yang Dai [slides]
2017: "E Kernel Fuzzing" by Richard Johnson at Black Hat USA [slides]
2017: "DIFUZE: Interface Aware Fuzzing for Kernel Drivers" [slides] [paper]
2017: "SemFuzz: Semantics-based Automatic Generation of Proof-of-Concept Exploits" at CCS [paper]
2017: "kAFL: Hardware-Assisted Feedback Fuzzing for OS Kernels" at USENIX [paper]
2017: "How Double-Fetch Situations turn into DoubleFetch : A Study of Double Fetches in the Linux Kernel" at USENIX [paper]
2017: "DR. CHECKER: A Soundy Analysis for Linux Kernel Drivers" at USENIX [paper]
2016: "Using Static Checking To Find Security In The Linux Kernel" by Thakkar [slides]
2016: "UniSan: Proacti Memory Initialization to Eliminate Data Leakages" [paper]
2016: "An Analysis on the Impact and Detection of Kernel Stack Infoleaks" [paper]
2016: "Syzkaller, Future De" by Dmitry at Linux Plumbers [slides]
2016: "Co kernel fuzzing with syzkaller" [article]
2016: "Filesystem Fuzzing with American Fuzzy Lop" by Nossum and Quentin Casasnovas [slides]
2016: "Project Triforce: AFL + QEMU + kernel = CVEs! (or) How to use AFL to fuzz arbitrary VMs" at ToorCon [slides]
2015: "KernelAddressSanitizer (KASan): a fast memory error detector for the Linux kernel" by Andrey Konovalov at LinuxCon North America [slides]
2015: "Introduction to USB and Fuzzing" by Matt DuHarte at DEF CON [video]
2015: "Don't Trust Your USB! How to Find Bugs in USB Device Drivers" by Sergej Schumilo et al. at Black Hat [video]
2012: "Comprehensi Instrumentation Binary Translation" [paper]
2010: "Automatic Bug-finding Techniques for Linux Kernel" by Jiri Slaby [paper]
2009: "Opensource Kernel Auditing and Exploitation" by Sil at DEF CON [video]
Defensive
2026: "Outrunning LLM Cutoffs: A Li Crash Resolution Benchmark for All" by Chenxi Huang et al. [paper]
2026: "DMGuard: Safeguarding Kernels from Physical-Page Use-After-Free " by Juhee Kim et al. [paper]
2026: "KernelRCA: Facilitating Root Cause Analysis of Memory Corruptions in Linux Kernel with Contextual Causality Chain" by Kangzheng Gu et al. [paper]
2026: "Sur the surge of new Linux LPE : Defense in Depth not dead" by Romain Huon [article]
"Linux Kernel Defence Map" by Alexander Popov
2025: "Enhancing FineIBT" by Jake Edge [article]
2025: "Linux Kernel Runtime Guard (LKRG) 1.0" by Solar Designer [slides]
2025: "Prioritizing the Linux OS Hardening and C" by Baoli Zhang [video]
2025: "Kernel Hardening With Protection Keys" by Ke [video]
2025: "Upstream Kernel Hardening: Progress on Enabling -Wflex-array-member-not-at-end" by Gustavo A. R. Sil] [video]
2025: "Linux Kernel Hardening: Ten Years Deep" by Kees Cook [slides] [video]
2025: "IUBIK: Isolating User Bytes in Commodity Operating System Kernels Tagging Extensions" by Marius Momeu et al. [paper]
2025: "Linux kernel Rust module for rootkit detection" by Antoine Doglioli [article] [代码]
2025: "Enhancing spatial safety: fixing thousands of -Wflex-array-member-not-at-end warnings" by Gustavo A. R. Sil]
2024: "KernJC: Automated En Generation for Linux Kernel " [paper] [slides] [代码]
2024: "Diving into Linux kernel security" by Alexander Popo]
2024: "A Decade of Low-hanging Fruit in the Linux Kernel" by Kees Cook [slides]
2024: "An ad with formal of Linux kernel 代码" by Julia Lawall [slides] [video]
2024: "Diving into the kernel mitigations" by Breno Leitao [video]
2024: "Security Features status update" by Kees Cook [slides] [video]
2024: "Restricting Unpri User Namespaces In Ubuntu" by John Johansen and Maxime Belair [slides] [video]
2024: "Enhancing spatial safety: fixing thousands of -Wflex-array-member-not-at-end warnings" by Gustavo A. R. Sil] [video]
2024: "Challenges and Inno Towards Spatial Safety in the Linux Kernel" by Gustavo A. R. Sil]
2024: "Agni: Fast Formal of the 's Range Analysis" by Paul Chaignon [slides] [video]
2024: "Lazy Abstraction Refinement with Proof" by Hao Sun and Zhendong Su.pdf) [video]
2024: "Improving eBPF Complexity with a Hardware-backed Isolation En" by Zhe Wang [video]
2024: "Towards Safe Kernel Extensibility With eBPF" by Soo Yee Lim [paper] [slides] [video]
2024: "Stop! Sandboxing Exploitable Functions and Modules Using In-Kernel Machine Learning" [slides]
2024: "ISLAB: Immutable Memory Management Metadata for Commodity Operating System Kernels" [paper]
2024: "SeaK: Rethinking the Design of a Secure Allocator for OS Kernel" [paper] [slides] [artifacts]
2024: "MOAT: Towards Safe BPF Kernel Extension" [paper] [slides] [artifact]
2024: "SafeFetch: Practical Double-Fetch Protection with Kernel-Fetch Caching" [paper] [slides] [artifacts]
2024: "Reducing Maintenance Burden by Bending C" by Mathias Krause [article]
2024: "BeeBox: Hardening BPF against Transient Execution Attacks" by Di Jin et al. [paper] [代码]
2024: " the eBPF Embedding" by Hao Sun and Zhendong Su [paper]
2024: "Beyond the Edges of Kernel Control-Flow Hijacking Protection with HEK-CFI" by Lukas Maar et al. [paper]
2024: "On Kernel's Safety in the Spectre Era (And KASLR is Formally Dead)" by Davide Davoli et al. [paper]
2024: "Challenges and inno towards safer flexible arrays in the Linux Kernel" by Gustavo A. R. Sil]
2024: "Mitigating Integer O in C" by Kees Cook [slides] [video]
2024: "Gaining bounds-checking on trailing arrays in the Upstream Linux Kernel" by Gustavo A. R. Sil]
2024: "A Hybrid Alias Analysis 框架 and Its Application to Protecting the Linux Kernel" by Guoren Li [video]
2024: "Hardening the kernel against heap-spraying attacks" by Jonathan Corbet [article]
2024: "Notes on the 'slab: Introduce dedicated bucket allocator' series" by Julien [article]
2023: "Modern LInux Kernel Mitigations" by Ray and Matthew Kurz [video]
2023: "An abridged history of Linux kernel hardening" by Russell Currey [video]
2023: "Exploring Linux's New Random Kmalloc Caches" by sam4k [article]
2023: "Toolchain security features status update" [slides] [video]
2023: "Enable MTE on Pixel 8" by Kees Cook [article]
2023: "Gaining bounds-checking on trailing arrays in the Upstream Linux Kernel" by Gustavo A. R. Sil] [video]
2023: "CONSTIFY: Fast Defenses for New Exploits" by Mathias Krause [article]
2023: "Mitigating Security Risks in Linux with KLAUS: A Method for E Patch Correctness" [paper] [slides]
2023: "Progress On Bounds Checking in C and the Linux Kernel" by Kees Cook and Gustavo A. R. Sil] [video]
2023: "Mobile Exploitation - The past, present, and the future" by Ki Chan Ahn [slides]
2023: "Bounded Flexible Arrays in C" by Kees Cook [article]
2022: "Survey of security mitigations and architectures, December 2022" by Saar Amar [article]
2022: "Canary in the Kernel Mine: Exploiting and Defending Against Same-Type Object Reuse" by Mathias Krause [article] [reference exploits]
2022: "Making Linux Kernel Exploit Cooking Harder" [article] [reference exploits] [proposed mitigations]
2022: "Where are we on security features?" [slides] [video]
2022: "Control-Flow Integrity Kernel Support" [slides] [video]
2022: "HotBPF - An On-demand and On-the-fly Memory Protection for the Linux Kernel" [video]
2022: "Mind The Gap - The Linux Ecosystem Kernel Patch Gap" by Jakob Lell and Regina Biro [video]
2022: "The exploit recon 'msg_msg' and its mitigation in VED" [article]
2022: "Return to sender: Detecting kernel exploits with eBPF" by Guillaume Fournier at Black Hat USA [slides] [代码]
2022: "Meaningful Bounds Checking in the Linux Kernel" by Kees Cook [slides]
2022: "Compilers: The Old New Security Frontier" by Brad Spengler [slides]
2022: "In-Kernel Control-Flow Integrity on Commodity OSes using ARM Pointer Authentication" [paper] [slides]
2022: "Pre Kernel Hacks with HAKC" [paper]
2022: "Mitigating Processor by Restructuring the Kernel Address Space" by Sebastian Eydam [slides]
2022: "Meaningful Bounds Checking in the Linux Kernel" by Kees Cook at Linux Conf AU [slides] [video]
2022: "Mitigating kernel risks on 32-bit ARM" by Ard Biesheuvel [article]
2022: "Kernel Hardening for 32-bit Arm Processors" by Keith Packard at Linux Conf AU [video]
2021: "Mitigating Linux kernel memory corruptions with Arm Memory Tagging" by Andrey Konovalo] [video]
2021: "Attack surface analysis of the Linux kernel based on complexity metrics" by Stefan Ba [thesis]
2021: "Midas: Systematic Kernel TOCTTOU Protection" at USENIX [paper] [slides]
2021: "Undo Workarounds for Kernel Bugs" at USENIX [paper] [slides] [video]
2021: "SHARD: Fine-Grained Kernel Specialization with Context-Aware Hardening" at USENIX [slides] [video]
2021: "Mitigation of Kernel Memory Corruption Using Multiple Kernel Memory Mechanism" [paper]
2021: "Hardware-Assisted Fine-Grained Control-Flow Integrity: Adding Lasers to Intel's CET/IBT" by Joao Moreira [slides] [video]
2021: "Kernel Self-Protection Project" by Kees Cook [slides] [video]
2021: "Compiler Features for Kernel Security" by Kees Cook [slides] [video]
2021: "A proof-carrying approach to building correct and flexible in-kernel " [slides] [video]
2021: "How AUTOSLAB Changes the Memory Unsafety 游戏" by Zhenpeng Lin [article]
2021: "security things in Linux vX.X" by Kees Cook [articles]
2021: "Undo Workarounds for Kernel Bugs" [paper]
2020: "Mitigating (Some) Use-after-frees in the Linux Kernel" by Jann Horn [slides]
2020: "Kernel Integrity Enforcement with HLAT In a Machine" by Chao Gao [slides] [video]
2020: "Linux kernel heap quarantine use-after-free exploits" by Alexander Popo]
2020: "State of Linux kernel security" by Dmitry [slides] [video]
2020: "LKRG IN A NUTSHELL" by Adam Zabrocki at OSTconf [slides]
2020: "Following the Linux Kernel Defence Map" by Alexander Popov at Linux Plumbers [slides] [video]
2020: "Memory Tagging for the Kernel: Tag-Based KASAN" by Andrey Konovalo] [video]
2020: "10 Years of Linux Security - A Report Card" by Bradley Spengler [slides] [video]
2020: "Control Flow Integrity in the Linux Kernel" by Kees Cook at linux.conf.au [slides] [video]
2020: "Identification of Kernel Memory Corruption Using Kernel Memory Secret Obser Mechanism" [paper]
2019: "Camouflage: Hardware-assisted CFI for the ARM Linux kernel" [paper]
2019: "A New Proposal for Protecting Kernel Data Memory" by Igor Stoppa at Linux Security Summit EU [video]
2019: "Control-Flow Integrity for the Linux kernel: A Security E" by Federico Manuel Bento [thesis]
2019: "Kernel Self-Protection Project" by Kees Cook [slides]
2019: "Touch but don’t look - Running the Kernel in Execute-only memory" by Rick Edgecombe [slides]
2019: "Breaking and Protecting Linux Kernel Stack" by Elena Resheto]
2019: "Making C Less Dangerous in the Linux Kernel" by Kees Cook [slides]
2019: "Mitigation for the Kernel Space Mirroring Attack (内核镜像攻击的缓解措施)" [article]
2018: "The State of Kernel Self Protection" by Kees Cook [slides]
2018: "Android Kernel Control Flow Integrity Analysis (分析)" [article]
2018: "O and Recent De: Kernel Self-Protection Project" by Kees Cook [slides]
2018: "The Last Man Standing: The Only Practical, Lightweight and Hyper Kernel Protector Struggling with the Real World Alone" by Seunghun Han at be]
2018: "Linux Kernel Runtime Guard (LKRG) under the hood" by Adam Zabrocki at CONFidence [slides] [video]
2018: "GuardION: Practical Mitigation of DMA-based Rowhammer Attacks on ARM" [paper]
2018: "kR^X: Comprehensi Protection Against Just-In-Time 代码 Reuse" at BlackHat [video]
2018: "KASR: A Reliable and Practical Approach to Attack Surface Reduction of Commodity OS Kernels" [paper]
2018: "The State of Kernel Self Protection" by Kees Cook at Linux Conf AU [slides]
2017: "kR^X: Comprehensi Protection against Just-In-Time 代码 Reuse" [paper]
2017: "How STACKLEAK impro kernel security" by Alexander Popov at Linux Piter [slides]
2017: "Shadow-Box: The Practical and Omnipotent Sandbox" by Seunghun Han at HitB [slides]
2017: "Towards Linux Kernel Memory Safety" [paper]
2017: "Proposal of a Method to Prevent Pri Escalation Attacks for Linux Kernel" [slides]
2017: "Linux Kernel Self Protection Project" by Kees Cook [slides]
2017: "PT-Rand: Practical Mitigation of Data-only Attacks against Page Tables" [paper] [slides] [video]
2017: "KASLR is Dead: Long Li" [paper]
2017: "Honey, I shrunk the attack surface – Ad in Android security hardening" by Nick Kralevich [video]
2017: "Fine Grained Control-Flow Integrity for The Linux Kernel" by Sandro Rigo et al. [slides]
2016: "Enforcing Kernel Security In with Data Flow Integrity" by Chengyu Song et al. [paper]
2016: "Thwarting unknown bugs: hardening features in the mainline Linux kernel" by Mark Rutland [slides]
2016: "Emerging Defense in Android Kernel" by James Fang [article]
2016: "Randomizing the Linux kernel heap freelists" by Thomas Garnier [article]
2015: "RAP: RIP ROP" [slides]
2015: "Protecting Commodity Operating Systems through Strong Kernel Isolation" by Kemerlis [paper]
2014: "Kernel Self-Protection through Quantified Attack Surface Reduction" by Anil Kurmus [paper]
2014: "A Tale of Two Kernels: Towards Ending Kernel Hardening Wars with Split Kernel" by Anil Kurmus and Robby Zippel [paper]
2013: "KASLR: An Exercise in Cargo Cult Security" by Brad Spengler [article]
2012: "How do I mitigate against NULL pointer dereference ?" by RedHat [article]
2011: "Linux kernel : State-of-the-art defenses and open problems" [paper]
2009: "Linux Kernel Heap Tampering Detection" by Larry Highsmith [article]
Exploits
[2010-2011]
(C exploit with LKRG bypass)
[FUZE]
[KEPLER]
[C]
[C]
Linux Kernel SCTP FORWARD-TSN Chunk Memory Corruption Remote Exploit [C]
[C]
[C]
[notes] [discussion]
[C]
[C]
[C]
[C]
[C]
[C] [Copy Fail]
[C] [Copy Fail]
[C] [Copy Fail]
[C] [Copy Fail]
[C] [Copy Fail]
[Dirty CBC] [Dirty Decrypt]
[Fragnesia GRO]
[C]
[C]
[C]
[C]
[C]
[C]
Tools
Fuzzers
[race-condition]
[notes]
[article]
Assorted
Kernel Address Space Layout Derandomization (KASLD)
[demo video]
Practice
Workshops
"pwn.college: Kernel Security" [workshop]
"pwn.college: Kernel Exploitation" [workshop]
2021: "Linux kernel exploit de" [workshop]
2020: "Android Kernel Exploitation" by Ashfaq Ansari [workshop] [video]
CTF Tasks
github.com/smallkirby/kernelpwn
github.com/MaherAzzouzi/LinuxKernelExploitation
github.com/AravGarg/kernel-hacking/ctf-challs
FrancescoLucarini/Linux-Kernel-CTF-exploits
mephi42/ctf
HackTheBox (knote): writeup
DiceCTF Quals 2026 (cornelslop): writeup, writeup 2
TRX CTF Quals 2026 (krwd): writeup
TRX CTF Quals 2026 (baby_smallest): writeup
ASIS CTF 2025 (FileNo): writeup
TRXCTF 2025 (/dev/mem): writeup
TRXCTF 2025 (baby_small): writeup
ToHCTF 2025 (krwx): writeup
backdoor CTF 2025 (): writeup
WMCTF 2025 (wm_easyker): writeup
STAR Labs Summer Pwnables 2025 (paradox_engine): writeup
BlackHat MEA 2025 Quals (Kinc): writeup1, writeup 2
corCTF 2025 (corphone): writeup
MCTF 2025 (Sec Mem): writeup
TsukuCTF 2025 (easy_kernel, xcache, new_era): writeup
LACTF 2025 (messenger): writeup
AVSS 2024 Final: writeups
crewCTF 2024 (kUlele): writeup
HITCON CTF QUAL 2024 (Halloween): writeup
EuskalHack 2024 Gau-Hack: writeup
RWCTF 2024 (RIPTC): 源码, writeup, writeup 2
DownUnderCTF 2024 (Faulty Kernel): writeup
D^3CTF 2023 (d3kcache): writeup, source
Imaginary CTF 2023 (Windows of Opportunity): writeup 1, writeup 2
HITCON CTF 2023 (wall-rose): writeup
corCTF 2023 (sysruption): writeup, writeup 2
corCTF 2023 (zeroday, kcipher): writeup
corCTF 2023 (kcipher): writeup
corCTF 2022 (cache-of-castaways): writeup
hxp CTF 2022 (one_byte): writeup
BFS Ekoparty 2022 (blunder): writeup
D^3CTF 2022 (d3bpf): writeup.html), writeup 2
zer0pts CTF 2022 (kRCE): writeup
HITCON CTF 2022 (fourchain-kernel): writeup and exploit
CTF 2021 (IPS): writeup, writeup 2, writeup 3, writeup 4
N1 CTF 2021 (baby-guess): 源码, writeup
Balsn CTF 2021 (futex): source, writeup
TSG CTF 2021 (lkgit): writeup, writeup 2, writeup 3
Midnightsun Quals 2021 (BroHammer): writeup
0ctf2021 (kernote): 源码, exploit, and writeup, writeup 2
corCTF 2021 (fire-of-sal): 源码, writeup
corCTF 2021 (wall-of-perdition): 源码, writeup, writeup 2
Google CTF 2021 (pwn-fullchain): 源码, writeup
Google CTF 2021 (pwn-ebpf): 源码, writeup
3kCTF 2021 (echo): source and exploit
3kCTF 2021 (klibrary): source, writeup
DEF CON CTF Qualifier 2021 (pza999): 源码 and exploit
DiceCTF 2021 (HashBrown): writeup
hxp CTF 2020 (pfoten): source, writeup
hxp CTF 2020 (kernel-rop): writeup
CUCTF 2020 (Hotrod): writeup
SpamAndFlags 2020 (Secstore): writeup
BSidesTLV CTF 2020 (Kapara): writeup and exploit, video writeup
HITCON CTF 2020 (spark): 源码 and exploit #1, writeup and exploit #2, exploit #3
HITCON CTF 2020 (atoms): 源码 and exploit
N1 CTF 2020 (W2L): writeup
Seccon Online 2020 (Kstack): 源码, exploit, and writeup
TokyoWesterns CTF 2020 (EEBPF): 源码, writeup
r2con CTF 2020: source, exploit
ASIS CTF 2020 (Shared House): writeup
DEF CON CTF Qualifier 2020 (fungez): 源码, exploit and writeup
DEF CON CTF Qualifier 2020 (keml): 源码, exploit
zer0pts CTF 2020 (meow): writeup
De1CTF 2019 (Race): writeup and exploit
r2con CTF 2019: 源码, exploit, and writeup
HITCON CTF Quals 2019 (PoE): 源码 and exploit
Balsn CTF 2019 (KrazyNote): exploit, writeup
TokyoWesterns CTF 2019 (gnote): writeup, video part 1, part 2
Security Fest 2019 (brainfuck64): writeup
Insomni'hack teaser 2019 (1118daysober): writeup 1, writeup 2
hxp CTF 2018 (Green Computing): writeup
WCTF 2018 (cpf): 源码, writeup, and exploit
SECT CTF 2018 (Gh0st): writeup
TWCTF 2018 (ReadableKernelModule): writeup
NCSTISC 2018 (babydriver): writeup, 源码 and exploit
Sharif CTF 2018 (kdb): writeup, 源码 and exploit
N1CTF 2018: writeup
Blaze2018 (blazeme): 源码 and exploit 1, soure and exploit 2
QWB2018 (solid_core): writeup, exploit 1, exploit 2, exploit 3
0ctf2018: writeup 1, writeup 2
TCTF 2017 (cred_jar): writeup
0ctf2017: 源码 and exploit 1, 源码 and exploit 2
0ctf2016: writeup, exploit
Insomni’hack finals 2015: writeup, 源码 and exploit
CSAW CTF 2015: writeup 1, writeup 2, 源码 and exploit
CSAW CTF 2014: source and exploit
CSAW CTF 2013: writeup, 源码 and exploit
PlaidCTF 2013 (Servr): writeup, source
CSAW CTF 2011: writeup, source
rwth2011 CTF (ps3game): writeup
CSAW CTF 2010: writeup, 源码, 源码 and exploit
Other tasks
"Pawnyable: Linux Kernel Exploitation" by ptr-yudai [articles] [Holstein v3 writeup]
pwnable.kr tasks (syscall, rootkit, softmmu, towelroot, kcrc, exynos)
OffensiveCon 2023: bfsmatrix [task] [exploit]
Ekoparty 2022: blunder [task] [writeup 1] [writeup 2]
Playgrounds
Kernel Read Write eXecute (KRWX) [slides] [playground]
Infrastructure
Other lists
grsecurity/PaX Citations in Academic Research
Misc
2026: "ExploitGym: Can AI Agents Turn Security into Real Attacks?" by Zhun Wang et al. [paper]
2026: "What 20 years of kernel bugs taught us about finding the next one" by Jenny Qu [video]
2026: "Notes on io_uring bugs & exploitation" by Moe Acherir [article]
2026: "68,000 Kernel Bug Reproducers" by Palash Oswal [article]
2026: "Building the Pixel 8 kernel with MTE, KASAN and KCOV" by Berk Cem Goksel [article]
2026: "Exploring NVIDIA Linux Drivers Internals Basics" by Moe Acherir [article]
2026: "Black-hat LLMs" by Nicholas Carlini [video]
2026: "Update on the SLUB allocator sheaves" by Babka [slides]
2026: "More timing side-channels for the page cache" by Daroc Alden [article]
2026: "Process Hijacking : Stealing File Descriptors for Post-Exploitation Shells" by Ali Raza [article]
2026: "Hiding from the Panic Button: Singularity SysRq Hook" by MatheuZ [article]
2026: "Breaking eBPF Security: How Kernel Rootkits Blind Obser Tools" by MatheuZ [article]
2026: "Crushing Pwn2Own & H1 with Kernel Dri" [video]
2025: "Notes on refcounting and Unix Garbage Collector in the Linux Kernel" by Moe Acherir [article]
2025: "The Joys of Linux Kernel ROP Gadget Scanning" by Jennifer Miller [article]
2025: "Singularity: Deep Dive into a Modern Stealth Linux Kernel Rootkit" by MatheuZSec [article]
2025: "Exploiting a 13-years old bug on QEMU" [article]
2025: "LinkPro: eBPF rootkit analysis" by Theo Letailleur [article]
2025: "The anatomy of a bug: 6 Months at STAR Labs" by Gerrard Tai [article]
2025: "Qualcomm DSP Kernel Internals" by Shreyas Penkar [article]
2025: "Debugging the Pixel 8 kernel via KGDB" by Andrey Konovalo]
2025: "Triaging CVEs for the Linux Kernel" by Christoph Steiger [slides] [video]
2025: "Beating the kCTF PoW with A for $51k" by Timothy Herchen [article]
2025: "Redefining Indirect Call Analysis with KallGraph" by Guoren Li et al. [paper] [代码]
2025: "A Quick Dive Into The Linux Kernel Page Allocator" by D3vil [article]
2025: "Musing from Decades of Linux Kernel Security Research" by Joshua Drake [slides]
2025: "Understanding Socket Internals Through a Series of C" by Pumpkin Chang [article]
2025: "Building a Mali GPU Debug En" by Pumpkin Chang [article]
2025: "ENOMEM In Linux Kernel" by Pumpkin Chang [article]
2025: "How Does Linux Direct Mapping Work?" by Pumpkin Chang [article]
2025: "Linux Kernel TLS" by Pumpkin Chang [article] [part 2]
2025: "Linux KASLR Entropy" by Pumpkin Chang [article]
2024: "Trying to Enable KCOV on Samsung Galaxy S22" by Kuzey Arda Bulut [article]
2024: "Binder Internals" [article]
2024: "Linternals: Exploring The mm Subsystem via mmap" by Samuel Page [article] [part 2]
2024: "Approaches to determining the attack surface for fuzzing the Linux kernel" by Pa and Aleksey Yakunin [paper]
2024: "The Feasibility of Using Hardware Breakpoints To Extend the Race Window" by Pumpkin Chang [article]
2024: "Linux Kernel Heap Spraying Over A 网络 Connection" by Pumpkin Chang [article]
2024: "Dashing Kernel Exploitation" by Eduardo Vela and Jordy Zomer [slides] [代码] [dashboard] new dashboard
2024: "Linux Kernel Attack Surface: beyond IOCTL. DMA-BUF" by Sla [article]
2024: "More Bang for Your Bug!" by Eduardo Vela and Space Meyer [slides] [video]
2024: "Linux Kernel CVEs, What Has Caused So Many to Suddenly Show Up?" by Greg Kroah-Hartman [slides] [video]
2024: "Reverse Engineering a Kernel Dri: S01 E01" [video] [E02]
2024: "Love and hate - The cyber tale between fuzzer and exploits in Linux kernel" by Zou Xiaochen [video] [slides]
2024: "Reflections on RANDSTRUCT in GrapheneOS" by Julien [article]
2024: "Linux Kernel Security Process or Why are there so many kernel CVEs now?” by Greg Kroah-Hartman [slides]
2024: "Who opened this big hole in the Linux kernel?" [article]
2024: "KernJC: Automated En Generation for Linux Kernel " [paper]
2024: "silent syscall hooking on arm64 linux s" [article]
2024: "C: A Linux CNA Case Study" by Brad Spengler [article]
2024: "Make your own backdoor: CFLAGS 代码 injection, Makefile injection, pkg-config" by Nossum [article]
2024: "Demo showing Claude Opus does not find C" by Sean Heelan [article]
2024: "Linux is a CNA" by Greg Kroah-Hartman [article]
2024: "An In of Patch Porting Practices of the Linux Kernel Ecosystem" [paper] [video]
2023: "Syzbot: 7 years of continuous kernel fuzzing" by Aleksandr Nogikh [slides] [video]
2023: "Operating system security: how to get into the subject" by Alexander Popo]
2023: "Demystifying the Linux kernel security process" by Greg Kroah-Hartman [slides] [video]
2023: "Rustproofing Linux" by Domen Puncer Kugler [article] [part 2] [part 3] [part 4]
2023: "What is a 'good' Linux Kernel bug?" by Ben Hawkes [article]
2023: "Analysing Linux Kernel Commits" [article]
2022: "Mind the Gap" by Ian Beer [article]
2022: "Designing subsystems for FUZZ-ability" by Dmitry [slides] [video]
2022: "Making syzbot reports more de" by Aleksandr Nogikh [slides] [video]
2022: "Peeking into the BPF " by Shung-Hsi Yu [slides]
2022: "So You Wanna Pwn The Kernel?" by Samuel Page [article]
2022: "Automated RE of Kernel Configurations" by zznop [article]
2021: "An In of the Android Kernel Patch Ecosystem" at USENIX [paper] [slides] [video]
2021: "The Complicated History of a Simple Linux Kernel API" [article]
2021: "On the Feasibility of Stealthily Introducing in Open-源码 Software Commit" [paper]
2020: "Checklist for when you get stuck with a Kernel Exploit" [article]
2020: "Android / Linux SLUB aliasing for general- and special-purpose caches" by Nikolenko [video]
2018: "Binder transactions in the bowels of the Linux Kernel" by Jean-Baptiste Cayrou [article]
grsecurity C [spreadsheet]
Syzkaller Co Dashboard
kernel vulns missing stable backports [源码]
项目信息
开发语言：未知
Star 数：6652
技术要点
该项目属于黑客技术方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕A collection of links related to Linux kernel security and exploitation展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。
从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。
使用与学习建议
1. 下载源码压缩包，解压到本地环境。
2. 根据项目类型准备对应的运行环境与依赖。
3. 按照 README 中的步骤完成配置与部署。
4. 在隔离的测试环境中运行验证，避免影响生产系统。
免责声明
本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。
| 资源标题 | linux-kernel-exploitation - A collection of links related to Linux kernel secu |
| 所属分类 | 黑客技术 |
| 发布作者 | admin |
| 发布时间 | 2026-10-05 22:07:37 |
| 下载权限 | 免费下载 |
| 附件数量 | 2 个下载链接 |
| 浏览次数 | 492 |
| 讨论数量 | 0 |
| 主题状态 | 正常讨论中 |